)]}'
{
  "commit": "b97df54c31d6c4cc2a28a3c83725366d52329223",
  "tree": "4fd9352aa2ac883ba215e1cc2394540c3de09281",
  "parents": [
    "2837c395526476e31fb15dbb948ed77389cdc75b"
  ],
  "author": {
    "name": "Brad Fitzpatrick",
    "email": "bradfitz@golang.org",
    "time": "Mon Jul 18 06:05:24 2016 +0000"
  },
  "committer": {
    "name": "Chris Broadfoot",
    "email": "cbro@golang.org",
    "time": "Mon Jul 18 14:58:26 2016 +0000"
  },
  "message": "net/http, net/http/cgi: fix for CGI + HTTP_PROXY security issue\n\nBecause,\n\n* The CGI spec defines that incoming request header \"Foo: Bar\" maps to\n  environment variable HTTP_FOO \u003d\u003d \"Bar\". (see RFC 3875 4.1.18)\n\n* The HTTP_PROXY environment variable is conventionally used to configure\n  the HTTP proxy for HTTP clients (and is respected by default for\n  Go\u0027s net/http.Client and Transport)\n\nThat means Go programs running in a CGI environment (as a child\nprocess under a CGI host) are vulnerable to an incoming request\ncontaining \"Proxy: attacker.com:1234\", setting HTTP_PROXY, and\nchanging where Go by default proxies all outbound HTTP requests.\n\nThis is CVE-2016-5386, aka https://httpoxy.org/\n\nFixes #16405\n\nChange-Id: I6f68ade85421b4807785799f6d98a8b077e871f0\nReviewed-on: https://go-review.googlesource.com/25010\nRun-TryBot: Chris Broadfoot \u003ccbro@golang.org\u003e\nTryBot-Result: Gobot Gobot \u003cgobot@golang.org\u003e\nReviewed-by: Chris Broadfoot \u003ccbro@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2eea64334b63c14328d2db658dd21aae4fe76dcc",
      "old_mode": 33188,
      "old_path": "src/net/http/cgi/host.go",
      "new_id": "58e9f7132a86cbffdf569b196a0ae38049f9e045",
      "new_mode": 33188,
      "new_path": "src/net/http/cgi/host.go"
    },
    {
      "type": "modify",
      "old_id": "70c5aff5e29932912461edf0101552c481d8577f",
      "old_mode": 33188,
      "old_path": "src/net/http/cgi/host_test.go",
      "new_id": "11213349a71b1be9a672e8be48a55812290258e9",
      "new_mode": 33188,
      "new_path": "src/net/http/cgi/host_test.go"
    },
    {
      "type": "modify",
      "old_id": "0c81b55e12b6728840b295c4a5336b62668cd389",
      "old_mode": 33188,
      "old_path": "src/net/http/transport.go",
      "new_id": "9164d0d827c0017af81673c450f009622681e3e3",
      "new_mode": 33188,
      "new_path": "src/net/http/transport.go"
    },
    {
      "type": "modify",
      "old_id": "d653a5a7fc1e4bbf4b98b7cace9ac998e72c69de",
      "old_mode": 33188,
      "old_path": "src/net/http/transport_test.go",
      "new_id": "72b98f16d7eaa0ca9b726034c807e5fd0daa598a",
      "new_mode": 33188,
      "new_path": "src/net/http/transport_test.go"
    }
  ]
}