)]}'
{
  "commit": "062e0e5ce6df339dc26732438ad771f73dbf2292",
  "tree": "41cbca4ad13ccbda047133c39b61496df97225c7",
  "parents": [
    "1e1fa5903b760c6714ba17e50bf850b01f49135c"
  ],
  "author": {
    "name": "Ian Lance Taylor",
    "email": "iant@golang.org",
    "time": "Fri Nov 06 09:38:38 2020 -0800"
  },
  "committer": {
    "name": "Katie Hockman",
    "email": "katie@golang.org",
    "time": "Thu Nov 12 20:58:06 2020 +0000"
  },
  "message": "cmd/go, cmd/cgo: don\u0027t let bogus symbol set cgo_ldflag\n\nA hand-edited object file can have a symbol name that uses newline and\nother normally invalid characters. The cgo tool will generate Go files\ncontaining symbol names, unquoted. That can permit those symbol names\nto inject Go code into a cgo-generated file. If that Go code uses the\n//go:cgo_ldflag pragma, it can cause the C linker to run arbitrary\ncode when building a package. If you build an imported package we\npermit arbitrary code at run time, but we don\u0027t want to permit it at\npackage build time. This CL prevents this in two ways.\n\nIn cgo, reject invalid symbols that contain non-printable or space\ncharacters, or that contain anything that looks like a Go comment.\n\nIn the go tool, double check all //go:cgo_ldflag directives in\ngenerated code, to make sure they follow the existing LDFLAG restrictions.\n\nThanks to Imre Rad / https://www.linkedin.com/in/imre-rad-2358749b for\nreporting this.\n\nFixes CVE-2020-28367\n\nChange-Id: Ia1ad8f3791ea79612690fa7d26ac451d0f6df7c1\nReviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/895832\nReviewed-by: Than McIntosh \u003cthanm@google.com\u003e\nReviewed-by: Cherry Zhang \u003ccherryyz@google.com\u003e\nReviewed-on: https://go-review.googlesource.com/c/go/+/269658\nTrust: Katie Hockman \u003ckatie@golang.org\u003e\nTrust: Roland Shoemaker \u003croland@golang.org\u003e\nRun-TryBot: Katie Hockman \u003ckatie@golang.org\u003e\nTryBot-Result: Go Bot \u003cgobot@golang.org\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "b2701bf922e52927f0a34b28fc7cdffe62008f7a",
      "new_mode": 33188,
      "new_path": "misc/cgo/errors/badsym_test.go"
    },
    {
      "type": "modify",
      "old_id": "eef54f2d0f68cee1e3569b9a9a03fe9634e34fdf",
      "old_mode": 33188,
      "old_path": "src/cmd/cgo/out.go",
      "new_id": "81b28e24e4b23b540754daeb07b4c3429e2625a1",
      "new_mode": 33188,
      "new_path": "src/cmd/cgo/out.go"
    },
    {
      "type": "modify",
      "old_id": "7959e09c33b4f9e8aa0951b2e172bf9cfbb196cb",
      "old_mode": 33188,
      "old_path": "src/cmd/go/internal/work/exec.go",
      "new_id": "eb76ad4e27c92a321b4e805fc7ce4390492bda09",
      "new_mode": 33188,
      "new_path": "src/cmd/go/internal/work/exec.go"
    }
  ]
}