)]}'
{
  "commit": "61bb56ad63992a3199acc55b2537c8355ef887b6",
  "tree": "dd13ccd3ebee2f20c3ffa16feb2e12ae56068b1d",
  "parents": [
    "45504066d7eb369b5be47429806e64d2ba6eb43a"
  ],
  "author": {
    "name": "Filippo Valsorda",
    "email": "filippo@golang.org",
    "time": "Tue Aug 06 19:32:16 2019 -0400"
  },
  "committer": {
    "name": "Filippo Valsorda",
    "email": "filippo@golang.org",
    "time": "Mon Aug 12 23:12:29 2019 +0000"
  },
  "message": "net/url: make Hostname and Port predictable for invalid Host values\n\nWhen Host is not valid per RFC 3986, the behavior of Hostname and Port\nwas wildly unpredictable, to the point that Host could have a suffix\nthat didn\u0027t appear in neither Hostname nor Port.\n\nThis is a security issue when applications are applying checks to Host\nand expecting them to be meaningful for the contents of Hostname.\n\nTo reduce disruption, this change only aims to guarantee the following\ntwo security-relevant invariants.\n\n* Host is either Hostname or [Hostname] with Port empty, or\n  Hostname:Port or [Hostname]:Port.\n\n* Port is only decimals.\n\nThe second invariant is the one that\u0027s most likely to cause disruption,\nbut I believe it\u0027s important, as it\u0027s conceivable an application might\ndo a suffix check on Host and expect it to be meaningful for the\ncontents of Hostname (if the suffix is not a valid port).\n\nThere are three ways to ensure it.\n\n1) Reject invalid ports in Parse. Note that non-numeric ports are\n   already rejected if and only if the host starts with \"[\".\n\n2) Consider non-numeric ports as part of Hostname, not Port.\n\n3) Allow non-numeric ports, and hope they only flow down to net/http,\n   which will reject them (#14353).\n\nThis change adopts both 1 and 2. We could do only the latter, but then\nthese invalid hosts would flow past port checks, like in\nhttp_test.TestTransportRejectsAlphaPort. Non-numeric ports weren\u0027t fully\nsupported anyway, because they were rejected after IPv6 literals, so\nthis restores consistency. We could do only the former, but at this\npoint 2) is free and might help with manually constructed Host values\n(or if we get something wrong in Parse).\n\nNote that net.SplitHostPort and net.Dial explicitly accept service names\nin place of port numbers, but this is an URL package, and RFC 3986,\nSection 3.2.3, clearly specifies ports as a number in decimal.\n\nnet/http uses a mix of net.SplitHostPort and url.Parse that would\ndeserve looking into, but in general it seems that it will still accept\nservice names in Addr fields as they are passed to net.Listen, while\nrejecting them in URLs, which feels correct.\n\nThis leaves a number of invalid URLs to reject, which however are not\nsecurity relevant once the two invariants above hold, so can be done in\nGo 1.14: IPv6 literals without brackets (#31024), invalid IPv6 literals,\nhostnames with invalid characters, and more.\n\nTested with 200M executions of go-fuzz and the following Fuzz function.\n\n\tu, err :\u003d url.Parse(string(data))\n\tif err !\u003d nil {\n\t\treturn 0\n\t}\n\th :\u003d u.Hostname()\n\tp :\u003d u.Port()\n\n\tswitch u.Host {\n\tcase h + \":\" + p:\n\t\treturn 1\n\tcase \"[\" + h + \"]:\" + p:\n\t\treturn 1\n\tcase h:\n\t\tfallthrough\n\tcase \"[\" + h + \"]\":\n\t\tif p !\u003d \"\" {\n\t\t\tpanic(\"unexpected Port()\")\n\t\t}\n\t\treturn 1\n\t}\n\tpanic(\"Host is not a variant of [Hostname]:Port\")\n\nFixes CVE-2019-14809\nUpdates #29098\n\nChange-Id: I7ef40823dab28f29511329fa2d5a7fb10c3ec895\nReviewed-on: https://go-review.googlesource.com/c/go/+/189258\nReviewed-by: Ian Lance Taylor \u003ciant@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5c1708c83270be538253fe0cd6c19c622398254c",
      "old_mode": 33188,
      "old_path": "src/net/http/transport.go",
      "new_id": "f9d9f4451cdb635d83afa7894ac74baeb50e4e9d",
      "new_mode": 33188,
      "new_path": "src/net/http/transport.go"
    },
    {
      "type": "modify",
      "old_id": "ea01a2017e17f8bab13565990f5ba47109537c8b",
      "old_mode": 33188,
      "old_path": "src/net/http/transport_test.go",
      "new_id": "1a6f631ea209332ee98142c6bddb8b0108470111",
      "new_mode": 33188,
      "new_path": "src/net/http/transport_test.go"
    },
    {
      "type": "modify",
      "old_id": "982cfe6c0c45333f4485a0feff087c72be4db677",
      "old_mode": 33188,
      "old_path": "src/net/url/url.go",
      "new_id": "12ea35f0f9e02c96689084b58a0c695e208f7e9c",
      "new_mode": 33188,
      "new_path": "src/net/url/url.go"
    },
    {
      "type": "modify",
      "old_id": "e6d6ef8a838afcb55b6a42b688cceabd74b6b1e7",
      "old_mode": 33188,
      "old_path": "src/net/url/url_test.go",
      "new_id": "e83c86c424324e7b77b9598cc9bc6ff0709ba527",
      "new_mode": 33188,
      "new_path": "src/net/url/url_test.go"
    }
  ]
}