)]}'
{
  "commit": "c44088ecc4b0722636e0a305f9608d3047197282",
  "tree": "a971e4a0899abe18ccac120fb345502aaf628722",
  "parents": [
    "fe29a9b7b0236d3d45c254965580d6aff7fa8504"
  ],
  "author": {
    "name": "Jonathan Nieder",
    "email": "jrnieder@gmail.com",
    "time": "Sat Apr 18 20:54:13 2020 -0700"
  },
  "committer": {
    "name": "Jonathan Nieder",
    "email": "jrnieder@gmail.com",
    "time": "Sun Apr 19 16:10:58 2020 -0700"
  },
  "message": "credential: treat URL without scheme as invalid\n\nlibcurl permits making requests without a URL scheme specified.  In\nthis case, it guesses the URL from the hostname, so I can run\n\n\tgit ls-remote http::ftp.example.com/path/to/repo\n\nand it would make an FTP request.\n\nAny user intentionally using such a URL is likely to have made a typo.\nUnfortunately, credential_from_url is not able to determine the host and\nprotocol in order to determine appropriate credentials to send, and\nuntil \"credential: refuse to operate when missing host or protocol\",\nthis resulted in another host\u0027s credentials being leaked to the named\nhost.\n\nTeach credential_from_url_gently to consider such a URL to be invalid\nso that fsck can detect and block gitmodules files with such URLs,\nallowing server operators to avoid serving them to downstream users\nrunning older versions of Git.\n\nThis also means that when such URLs are passed on the command line, Git\nwill print a clearer error so affected users can switch to the simpler\nURL that explicitly specifies the host and protocol they intend.\n\nOne subtlety: .gitmodules files can contain relative URLs, representing\na URL relative to the URL they were cloned from.  The relative URL\nresolver used for .gitmodules can follow \"..\" components out of the path\npart and past the host part of a URL, meaning that such a relative URL\ncan be used to traverse from a https://foo.example.com/innocent\nsuperproject to a https::attacker.example.com/exploit submodule.\nFortunately a leading \u0027:\u0027 in the first path component after a series of\nleading \u0027./\u0027 and \u0027../\u0027 components is unlikely to show up in other\ncontexts, so we can catch this by detecting that pattern.\n\nReported-by: Jeff King \u003cpeff@peff.net\u003e\nSigned-off-by: Jonathan Nieder \u003cjrnieder@gmail.com\u003e\nReviewed-by: Jeff King \u003cpeff@peff.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7d433595913c8b17e8d9b493ae11d388b38bc5a8",
      "old_mode": 33188,
      "old_path": "credential.c",
      "new_id": "aedb64574def1542f24d9e8a09322779464cc97d",
      "new_mode": 33188,
      "new_path": "credential.c"
    },
    {
      "type": "modify",
      "old_id": "4e3bc8622f3103db10757669ffd555c0218cfdbd",
      "old_mode": 33188,
      "old_path": "fsck.c",
      "new_id": "41af5c0d5f54299b0474f1230a4dcf80daf80b1f",
      "new_mode": 33188,
      "new_path": "fsck.c"
    },
    {
      "type": "modify",
      "old_id": "8552184e741fe2465e746a3ac42d19edddb15576",
      "old_mode": 33261,
      "old_path": "t/t5550-http-fetch-dumb.sh",
      "new_id": "517202e47726a90cb43811649bd7b483ea1030c6",
      "new_mode": 33261,
      "new_path": "t/t5550-http-fetch-dumb.sh"
    },
    {
      "type": "modify",
      "old_id": "afdd2553d9100b306a5712555ed7b2d71481279f",
      "old_mode": 33261,
      "old_path": "t/t7416-submodule-dash-url.sh",
      "new_id": "249dc3d1d462f3bdb938313bf6f1e2a20063b1b4",
      "new_mode": 33261,
      "new_path": "t/t7416-submodule-dash-url.sh"
    }
  ]
}