)]}'
{
  "commit": "3a855208e3efed2e9d7c20ad023f1fa78afcc0be",
  "tree": "d69f1b22baeb446a10a68965385d284fa1eaf38b",
  "parents": [
    "337b8e9cbfa749d9d5c899e0dc358e2208d5e54f"
  ],
  "author": {
    "name": "Damien Neil",
    "email": "dneil@google.com",
    "time": "Thu Jan 11 11:31:57 2024 -0800"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Tue Mar 05 16:43:48 2024 +0000"
  },
  "message": "[release-branch.go1.22] net/http, net/http/cookiejar: avoid subdomain matches on IPv6 zones\n\nWhen deciding whether to forward cookies or sensitive headers\nacross a redirect, do not attempt to interpret an IPv6 address\nas a domain name.\n\nAvoids a case where a maliciously-crafted redirect to an\nIPv6 address with a scoped addressing zone could be\nmisinterpreted as a within-domain redirect. For example,\nwe could interpret \"::1%.www.example.com\" as a subdomain\nof \"www.example.com\".\n\nThanks to Juho Nurminen of Mattermost for reporting this issue.\n\nFixes CVE-2023-45289\nFixes #65859\nFor #65065\n\nChange-Id: I8f463f59f0e700c8a18733d2b264a8bcb3a19599\nReviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2131938\nReviewed-by: Tatiana Bradley \u003ctatianabradley@google.com\u003e\nReviewed-by: Roland Shoemaker \u003cbracewell@google.com\u003e\nReviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2174344\nReviewed-by: Carlos Amedee \u003camedee@google.com\u003e\nReviewed-on: https://go-review.googlesource.com/c/go/+/569236\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Michael Knyszek \u003cmknyszek@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ee6de24fc19e4fbe8003a3def4fdcc426acd0ae4",
      "old_mode": 33188,
      "old_path": "src/net/http/client.go",
      "new_id": "8fc348fe5d36e65404ac2ec873baa11d786b63b7",
      "new_mode": 33188,
      "new_path": "src/net/http/client.go"
    },
    {
      "type": "modify",
      "old_id": "7459b9cb6ed1df3a42d4ed54a54abc8748b3dffd",
      "old_mode": 33188,
      "old_path": "src/net/http/client_test.go",
      "new_id": "e2a1cbbdea10daae766576ba2492d9a35a6590ac",
      "new_mode": 33188,
      "new_path": "src/net/http/client_test.go"
    },
    {
      "type": "modify",
      "old_id": "59cde82cb380e30236698079763b37838c1ae96f",
      "old_mode": 33188,
      "old_path": "src/net/http/cookiejar/jar.go",
      "new_id": "e7f5ddd4d0096b9d036d6b7f4258d5695d9d9761",
      "new_mode": 33188,
      "new_path": "src/net/http/cookiejar/jar.go"
    },
    {
      "type": "modify",
      "old_id": "56d0695a660c07415a6f7cdd68993428719e06ae",
      "old_mode": 33188,
      "old_path": "src/net/http/cookiejar/jar_test.go",
      "new_id": "251f7c16171c3acc40be12a962eb7a48529699f8",
      "new_mode": 33188,
      "new_path": "src/net/http/cookiejar/jar_test.go"
    }
  ]
}