)]}'
{
  "commit": "a376e37b2c418b8f630741552d76a5b18c87c133",
  "tree": "96058d3faffda3c77f76f7a18807d126bf2c1203",
  "parents": [
    "b178c207d72bd814a8004cefc477a47b6602f0be"
  ],
  "author": {
    "name": "Jeff King",
    "email": "peff@peff.net",
    "time": "Fri Nov 15 04:06:07 2019 -0500"
  },
  "committer": {
    "name": "Junio C Hamano",
    "email": "gitster@pobox.com",
    "time": "Mon Nov 18 10:46:56 2019 +0900"
  },
  "message": "gitweb: escape URLs generated by href()\n\nThere\u0027s a cross-site scripting problem in gitweb, where it will print\nURLs generated by its href() helper without further quoting. This allows\nan attacker to point a victim to a specially crafted gitweb URL and\ninject arbitrary HTML into the resulting page (which the victim sees as\ncoming from gitweb).\n\nThe base of the URL comes from evaluate_uri(), which pulls the value of\n$REQUEST_URI via the CGI module. It tries to strip off $PATH_INFO, but\nfails to do so in some cases (including ones that contain special\ncharacters, like \"+\"). Most of the uses of the URL end up being passed\nto \"$cgi-\u003ea(-href \u003d href())\", which will get quoted properly by the CGI\nmodule. But in a few places, we output them ourselves as part of\nmanually-generated HTML, and whatever was in the original URL will\nappear unquoted in the output.\n\nGiven that all of the nearby variables placed into this manual HTML\n_are_ quoted, it seems like the authors assumed that these URLs would\nnot need quoting. So it\u0027s possible that the bug is actually in\nevaluate_uri(), which should be doing a more careful job of stripping\n$PATH_INFO. There\u0027s some discussion in a comment in that function, as\nwell as the commit message in 81d3fe9f48 (gitweb: fix wrong base URL\nwhen non-root DirectoryIndex, 2009-02-15). But I\u0027m not sure I understand\nit.\n\nRegardless, it\u0027s a good idea to quote these values at the point of\ninsertion into the HTML output:\n\n  1. Even if there is a bug in evaluate_uri(), this would give us\n     belt-and-suspenders protection.\n\n  2. evaluate_uri() is only handling the base. Some generated URLs will\n     also mention arbitrary refs or filenames in the repositories, and\n     these should be quoted anyway.\n\n  3. It should never _hurt_ to quote (and that\u0027s what all of the\n     $cgi-\u003ea() calls are doing already).\n\nSo there may be further work here, but this patch at least prevents the\nXSS vulnerability, and shouldn\u0027t make anything worse.\n\nThe test here covers the calls in print_feed_meta(), but I manually\naudited every call to href() to see how its output was used, and quoted\nappropriately. Most of them are esc_attr(), as they\u0027re used in tag\nattributes, but I used esc_html() when the URLs were printed bare. The\ndistinction is largely academic, as one is implemented as a wrapper for\nthe other.\n\nReported-by: NAKAYAMA DAISUKE \u003cnakyamad@icloud.com\u003e\nSigned-off-by: Jeff King \u003cpeff@peff.net\u003e\nSigned-off-by: Junio C Hamano \u003cgitster@pobox.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7fef19fe591c2dd077ec4688f20e3c7bec521f13",
      "old_mode": 33261,
      "old_path": "gitweb/gitweb.perl",
      "new_id": "a2cc4d9fb027ce18e877e139220e05a4b75e87cb",
      "new_mode": 33261,
      "new_path": "gitweb/gitweb.perl"
    },
    {
      "type": "modify",
      "old_id": "1b04c29037bc7f4386a6e50f57c8f0557e7edb52",
      "old_mode": 33261,
      "old_path": "t/t9502-gitweb-standalone-parse-output.sh",
      "new_id": "e38cbc97d38e41ae8bdf5c8d11695e06257dfa0b",
      "new_mode": 33261,
      "new_path": "t/t9502-gitweb-standalone-parse-output.sh"
    }
  ]
}