)]}'
{
  "commit": "cabdf7fdd04d48d283de41e93dcb36d0da21fb10",
  "tree": "a708ccbce5cf4917bf65642788a1d1f6ff50913d",
  "parents": [
    "ac2b8fc093d50e027914d3bc2cde963172a62895"
  ],
  "author": {
    "name": "harjoth",
    "email": "harjoth.khara@gmail.com",
    "time": "Mon Jun 15 02:38:13 2026 +0000"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Thu Jun 18 08:31:44 2026 -0700"
  },
  "message": "net/http: validate trailers when writing requests and responses\n\nWhen writing an HTTP/1 request or response, trailer names were copied\nverbatim onto the \"Trailer:\" declaration line by writeHeader. The only\nprior filtering was a switch rejecting the three reserved keys, and\nCanonicalHeaderKey returns a key containing invalid bytes unchanged, so a\ntrailer name such as \"X-Trailer\\r\\nInjected: 1\" was written to the wire as\nwritten, permitting header injection on the Trailer line.\n\nValidate trailer names and values in newTransferWriter, which is the shared\nHTTP/1 serialization path for Request.Write and Response.Write, before any\ntrailer is written. Names that fail httpguts.ValidHeaderFieldName and values\nthat fail httpguts.ValidHeaderFieldValue now cause the write to return an\nerror.\n\nThis path is distinct from Transport.roundTrip, which already validates\nreq.Trailer for client requests, and from the HTTP/2 and server\nResponseWriter trailer paths, which validate separately. The gap closed\nhere is the direct Request.Write / Response.Write serialization used by\ncallers such as httputil and code that writes a request to a connection\ndirectly.\n\nRejecting invalid trailer values is stricter than the previous behavior, in\nwhich the final trailer block sanitized CR and LF to spaces via\nHeader.writeSubset rather than erroring. Values whose final value is set\nwhile the request body is read are still written through that sanitizing\npath; the new check covers values present when the write begins.\n\nFixes #78775\n\nChange-Id: I3ed66185ab262a215d0c8bbba005fd8b3df69acb\nGitHub-Last-Rev: 9337c9d3f207fe8080e2dfd6b7f99971a7c56f33\nGitHub-Pull-Request: golang/go#79971\nReviewed-on: https://go-review.googlesource.com/c/go/+/789960\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Emmanuel Odeke \u003cemmanuel@orijtech.com\u003e\nReviewed-by: Sayer Turner \u003csayerturner65@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Emmanuel Odeke \u003cemmanuel@orijtech.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "eb6e59888bae14524994137ba564f2f99d52ce84",
      "old_mode": 33188,
      "old_path": "src/net/http/request.go",
      "new_id": "a95e9916813667fe390892d12dd89cd81dfa7463",
      "new_mode": 33188,
      "new_path": "src/net/http/request.go"
    },
    {
      "type": "modify",
      "old_id": "8b097cd5e15d1f6f4e5ddb68095c9c322b18ab8f",
      "old_mode": 33188,
      "old_path": "src/net/http/requestwrite_test.go",
      "new_id": "8903f2c9266abed3010d97ca1f41129ee3f0c1a6",
      "new_mode": 33188,
      "new_path": "src/net/http/requestwrite_test.go"
    },
    {
      "type": "modify",
      "old_id": "226ad7225b2d71c37b06933839440c563107b985",
      "old_mode": 33188,
      "old_path": "src/net/http/responsewrite_test.go",
      "new_id": "84e0f3b43ae1ffe7cd254f621aa7a0dfafc6a600",
      "new_mode": 33188,
      "new_path": "src/net/http/responsewrite_test.go"
    },
    {
      "type": "modify",
      "old_id": "675551287fa3d642ed2e347236c4578f58e10f37",
      "old_mode": 33188,
      "old_path": "src/net/http/transfer.go",
      "new_id": "faa1c3853a134ea6d08f77322387ebca3366b4b6",
      "new_mode": 33188,
      "new_path": "src/net/http/transfer.go"
    }
  ]
}