)]}'
{
  "commit": "cd3b4ca9f20fd14187ed4cdfdee1a02ea87e5cd8",
  "tree": "66c94a8170569b344cf5880034a8f29d85fab86e",
  "parents": [
    "1811aeae66bee899317403c92c83b56673919775"
  ],
  "author": {
    "name": "Roland Shoemaker",
    "email": "roland@golang.org",
    "time": "Tue Mar 02 10:00:53 2021 -0800"
  },
  "committer": {
    "name": "Filippo Valsorda",
    "email": "filippo@golang.org",
    "time": "Wed Mar 10 18:18:28 2021 +0000"
  },
  "message": "archive/zip: fix panic in Reader.Open\n\nWhen operating on a Zip file that contains a file prefixed with \"../\",\nOpen(...) would cause a panic in toValidName when attempting to strip\nthe prefixed path components.\n\nFixes CVE-2021-27919\nFixes #44916\n\nChange-Id: Ic755d8126cb0897e2cbbdacf572439c38dde7b35\nReviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1004761\nReviewed-by: Filippo Valsorda \u003cvalsorda@google.com\u003e\nReviewed-by: Russ Cox \u003crsc@google.com\u003e\nReviewed-by: Katie Hockman \u003ckatiehockman@google.com\u003e\nReviewed-on: https://go-review.googlesource.com/c/go/+/300489\nTrust: Katie Hockman \u003ckatie@golang.org\u003e\nRun-TryBot: Katie Hockman \u003ckatie@golang.org\u003e\nTryBot-Result: Go Bot \u003cgobot@golang.org\u003e\nReviewed-by: Alexander Rakoczy \u003calex@golang.org\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8b4e77875fb3e69c93406372e17d94bb3f1b7d91",
      "old_mode": 33188,
      "old_path": "src/archive/zip/reader.go",
      "new_id": "c288ad965bc92cd4477e8c9da1eb8033d84c3cbe",
      "new_mode": 33188,
      "new_path": "src/archive/zip/reader.go"
    },
    {
      "type": "modify",
      "old_id": "34e96f7da43c2a79e26f2f2527a78f9265914163",
      "old_mode": 33188,
      "old_path": "src/archive/zip/reader_test.go",
      "new_id": "5faf1f49b51e7b8e4cd25fbb34dfd32d46ed03bd",
      "new_mode": 33188,
      "new_path": "src/archive/zip/reader_test.go"
    }
  ]
}