)]}'
{
  "commit": "b7a85e0003cedb1b48a1fd3ae5b746ec6330102e",
  "tree": "fe86fc80397496bbb065a7a1ae55799111b240b2",
  "parents": [
    "70fd4e47d73b92fe90e44ac785e2f98f9df0ab67"
  ],
  "author": {
    "name": "Damien Neil",
    "email": "dneil@google.com",
    "time": "Wed Jul 07 16:34:34 2021 -0700"
  },
  "committer": {
    "name": "Filippo Valsorda",
    "email": "filippo@golang.org",
    "time": "Fri Jul 30 14:01:30 2021 +0000"
  },
  "message": "net/http/httputil: close incoming ReverseProxy request body\n\nReading from an incoming request body after the request handler aborts\nwith a panic can cause a panic, becuse http.Server does not (contrary\nto its documentation) close the request body in this case.\n\nAlways close the incoming request body in ReverseProxy.ServeHTTP to\nensure that any in-flight outgoing requests using the body do not\nread from it.\n\nUpdates #46866\nFixes CVE-2021-36221\n\nChange-Id: I310df269200ad8732c5d9f1a2b00de68725831df\nReviewed-on: https://go-review.googlesource.com/c/go/+/333191\nTrust: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Brad Fitzpatrick \u003cbradfitz@golang.org\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5d39955d62d15fa962f8ead218e93a620af49a13",
      "old_mode": 33188,
      "old_path": "src/net/http/httputil/reverseproxy.go",
      "new_id": "8b63368386f43ba81a574e571ada7bcfffd195e0",
      "new_mode": 33188,
      "new_path": "src/net/http/httputil/reverseproxy.go"
    },
    {
      "type": "modify",
      "old_id": "1898ed8b8afdef4a1e0da64daa1c0cd480070483",
      "old_mode": 33188,
      "old_path": "src/net/http/httputil/reverseproxy_test.go",
      "new_id": "4b6ad77a29466fe0fbb9f1e79fa1bd804b2264ea",
      "new_mode": 33188,
      "new_path": "src/net/http/httputil/reverseproxy_test.go"
    }
  ]
}