)]}'
{
  "commit": "8fcee8abbea1bb959c63a6944f9ddf490a97f802",
  "tree": "e1ae61d1531695e5c0e770307adaeb7d319d857d",
  "parents": [
    "d571a77846dfee8efd076223a882915cd6cb52f4"
  ],
  "author": {
    "name": "Roberto Clapis",
    "email": "roberto@golang.org",
    "time": "Wed Aug 26 08:53:03 2020 +0200"
  },
  "committer": {
    "name": "Filippo Valsorda",
    "email": "valsorda@google.com",
    "time": "Tue Sep 01 12:31:38 2020 +0000"
  },
  "message": "[release-branch.go1.14-security] net/http/cgi,net/http/fcgi: add Content-Type detection\n\nThis CL ensures that responses served via CGI and FastCGI\nhave a Content-Type header based on the content of the\nresponse if not explicitly set by handlers.\n\nIf the implementers of the handler did not explicitly\nspecify a Content-Type both CGI implementations would default\nto \"text/html\", potentially causing cross-site scripting.\n\nThanks to RedTeam Pentesting GmbH for reporting this.\n\nFixes CVE-2020-24553\n\nChange-Id: I82cfc396309b5ab2e8d6e9a87eda8ea7e3799473\nReviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/823217\nReviewed-by: Russ Cox \u003crsc@google.com\u003e\n(cherry picked from commit 23d675d07fdc56aafd67c0a0b63d5b7e14708ff0)\nReviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/835312\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "cb140f8f2f643e43b9b47a36bec57ecbac916abe",
      "old_mode": 33188,
      "old_path": "src/net/http/cgi/child.go",
      "new_id": "2b210ea4a1ce7f6b6974f6078c8bf2fc2f0f386b",
      "new_mode": 33188,
      "new_path": "src/net/http/cgi/child.go"
    },
    {
      "type": "modify",
      "old_id": "14e0af475f5af90903a8f4668d44a173697eacea",
      "old_mode": 33188,
      "old_path": "src/net/http/cgi/child_test.go",
      "new_id": "f6ecb6eb80f24d3e163dea5d046c984f8590c4ce",
      "new_mode": 33188,
      "new_path": "src/net/http/cgi/child_test.go"
    },
    {
      "type": "modify",
      "old_id": "32d59c09a3c52be726386978852960b3677c45b0",
      "old_mode": 33188,
      "old_path": "src/net/http/cgi/integration_test.go",
      "new_id": "295c3b82d404ccd9bc520a0fb5cea2d90bfd5e67",
      "new_mode": 33188,
      "new_path": "src/net/http/cgi/integration_test.go"
    },
    {
      "type": "modify",
      "old_id": "30a6b2ce2dfe8335efce24b38c274bc0476fd8ed",
      "old_mode": 33188,
      "old_path": "src/net/http/fcgi/child.go",
      "new_id": "a31273b3eca7a64216da830dae33fb0fc9005ab1",
      "new_mode": 33188,
      "new_path": "src/net/http/fcgi/child.go"
    },
    {
      "type": "modify",
      "old_id": "e9d2b34023c81a392c6b1662eaff5a162f20cbfb",
      "old_mode": 33188,
      "old_path": "src/net/http/fcgi/fcgi_test.go",
      "new_id": "4a27a12c35a99e0cdb03d974161dd54deb65c0e7",
      "new_mode": 33188,
      "new_path": "src/net/http/fcgi/fcgi_test.go"
    }
  ]
}