)]}'
{
  "commit": "ed05b1054df10a2fbc68000cfdd429daec03a456",
  "tree": "21563e3f6537e7db4b26c446edc4d9b1f8cfbccc",
  "parents": [
    "e7e8cf1801b06a9f7f5092671b0413689a765fe7"
  ],
  "author": {
    "name": "Jason A. Donenfeld",
    "email": "Jason@zx2c4.com",
    "time": "Mon May 04 18:13:13 2026 +0200"
  },
  "committer": {
    "name": "Jason A. Donenfeld",
    "email": "Jason@zx2c4.com",
    "time": "Mon May 04 18:28:27 2026 +0200"
  },
  "message": "cgit: truncate all config values at the newline\n\nThese would be largely invalid anyway (save, I suppose, for Linux file\npaths that technically can contain new lines).\n\nThe actual problem is that these get printed back out into cached -- and\ntrusted -- cgitrc files, and if the fields have newlines, the git-config\nway of less trusted users configuring repos on a shared system can be\nabused to inject newlines, which then can be used to smuggle global\noptions (including filters, which execute code) into the cached cgitrc.\n\nSo now, only ever duplicate up to the newline, when dealing with these\ninputs.\n\nReported-by: Adrian Denkiewicz \u003cadrian@doyensec.com\u003e\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c33e6fce73c1c6237532ac891b2b08f0249c64ac",
      "old_mode": 33188,
      "old_path": "cgit.c",
      "new_id": "ca318e8a3db6389d646f6a8c6f457b17eb76d4da",
      "new_mode": 33188,
      "new_path": "cgit.c"
    },
    {
      "type": "modify",
      "old_id": "1db34739df2d57c21cdbc261d70186966635ae96",
      "old_mode": 33188,
      "old_path": "cgit.h",
      "new_id": "7d7ece74f1110711c786d843b045ad9a3cad38f6",
      "new_mode": 33188,
      "new_path": "cgit.h"
    },
    {
      "type": "modify",
      "old_id": "22b4970f6643d632b4290970a203c65c0c8db58f",
      "old_mode": 33188,
      "old_path": "filter.c",
      "new_id": "cb01d325112ce2f0fe9994f5883114022f3f15cd",
      "new_mode": 33188,
      "new_path": "filter.c"
    },
    {
      "type": "modify",
      "old_id": "867fcf7c3c272f1cc08a5363938b355175878856",
      "old_mode": 33188,
      "old_path": "scan-tree.c",
      "new_id": "c120efeeec6768c0ed1304f1df3c6bac877b7133",
      "new_mode": 33188,
      "new_path": "scan-tree.c"
    },
    {
      "type": "modify",
      "old_id": "cec2c81b56c976eb402a4542f0580b049a510c25",
      "old_mode": 33188,
      "old_path": "shared.c",
      "new_id": "8173eb893bf5e0e4a04beb0a0ba7bd7535c19b7e",
      "new_mode": 33188,
      "new_path": "shared.c"
    },
    {
      "type": "modify",
      "old_id": "d12e3dd3593fda4179740c4540aee02260f47007",
      "old_mode": 33188,
      "old_path": "ui-repolist.c",
      "new_id": "1b224cf42c5c52cb1434097144b3398cd326b67f",
      "new_mode": 33188,
      "new_path": "ui-repolist.c"
    }
  ]
}