)]}'
{
  "commit": "db9f7b028d8086e5fc66364e9beba1e3a2b99d48",
  "tree": "c59d61cd0b329aa487d173c7dfec48e696792fd4",
  "parents": [
    "e5a4c0d17e532824e0d379cb1c322296b07c73f9"
  ],
  "author": {
    "name": "Ivan Frade",
    "email": "ifrade@google.com",
    "time": "Mon Sep 24 16:03:35 2018 -0700"
  },
  "committer": {
    "name": "Matthias Sohn",
    "email": "matthias.sohn@sap.com",
    "time": "Fri Oct 05 21:38:22 2018 +0200"
  },
  "message": "SubmoduleAddCommand: Reject submodule URIs that look like cli options\n\nIn C git versions before 2.19.1, the submodule is fetched by running\n\"git clone \u003curi\u003e \u003cpath\u003e\". A URI starting with \"-\" would be interpreted\nas an option, causing security problems. See CVE-2018-17456.\n\nRefuse to add submodules with URIs, names or paths starting with \"-\",\nthat could be confused with command line arguments.\n\n[jn: backported to JGit 4.7.y, bringing portions of Masaya Suzuki\u0027s\n dotdot check code in v5.1.0.201808281540-m3~57 (Add API to specify\n the submodule name, 2018-07-12) along for the ride]\n\nChange-Id: I2607c3acc480b75ab2b13386fe2cac435839f017\nSigned-off-by: Ivan Frade \u003cifrade@google.com\u003e\nSigned-off-by: Matthias Sohn \u003cmatthias.sohn@sap.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5c46659c0a91df2746ed5b6e2b29afea1b24283a",
      "old_mode": 33188,
      "old_path": "org.eclipse.jgit.test/tst/org/eclipse/jgit/submodule/SubmoduleAddTest.java",
      "new_id": "93f47090a3912f4ba3f8e063893143f7df1abaeb",
      "new_mode": 33188,
      "new_path": "org.eclipse.jgit.test/tst/org/eclipse/jgit/submodule/SubmoduleAddTest.java"
    },
    {
      "type": "modify",
      "old_id": "4badd2c1c4f99341d45898cd2f0156e68b52d45f",
      "old_mode": 33188,
      "old_path": "org.eclipse.jgit/.settings/.api_filters",
      "new_id": "ed43015a3917058b9f26f4748b5b5dc5981dcbc5",
      "new_mode": 33188,
      "new_path": "org.eclipse.jgit/.settings/.api_filters"
    },
    {
      "type": "modify",
      "old_id": "34457c93674d1f1605317b8b4f24f8c6d88af576",
      "old_mode": 33188,
      "old_path": "org.eclipse.jgit/resources/org/eclipse/jgit/internal/JGitText.properties",
      "new_id": "2083e1eef9842c780e768ce9264665a456c9640c",
      "new_mode": 33188,
      "new_path": "org.eclipse.jgit/resources/org/eclipse/jgit/internal/JGitText.properties"
    },
    {
      "type": "modify",
      "old_id": "0519d454eaa64add935feb6d5847f08b4e2f5afb",
      "old_mode": 33188,
      "old_path": "org.eclipse.jgit/src/org/eclipse/jgit/api/SubmoduleAddCommand.java",
      "new_id": "e3ba8945df2993c0ce6a82e8b214757f2ac1c1be",
      "new_mode": 33188,
      "new_path": "org.eclipse.jgit/src/org/eclipse/jgit/api/SubmoduleAddCommand.java"
    },
    {
      "type": "modify",
      "old_id": "41f3c2a4886d0f837b646aa706c2aa1c43804b8e",
      "old_mode": 33188,
      "old_path": "org.eclipse.jgit/src/org/eclipse/jgit/internal/JGitText.java",
      "new_id": "8586763970cc682dd42751e41cc09534e1362fb8",
      "new_mode": 33188,
      "new_path": "org.eclipse.jgit/src/org/eclipse/jgit/internal/JGitText.java"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "4821c80f00f9ee3a04f81b82f2f590a377ff39c5",
      "new_mode": 33188,
      "new_path": "org.eclipse.jgit/src/org/eclipse/jgit/internal/submodule/SubmoduleValidator.java"
    }
  ]
}