)]}'
{
  "commit": "62e16441ea3b73c1fe17a70f2f1eb89f0e0b5088",
  "tree": "5378898cad2b43d653c7e32f222505102e5fe042",
  "parents": [
    "2807ae01c3c0b4886b2990e9e2b4d133f7fc5695"
  ],
  "author": {
    "name": "David Ostrovsky",
    "email": "david@ostrovsky.org",
    "time": "Fri Feb 13 12:06:58 2026 +0100"
  },
  "committer": {
    "name": "David Ostrovsky",
    "email": "david@ostrovsky.org",
    "time": "Fri Feb 13 13:43:46 2026 +0100"
  },
  "message": "Replace commons-codec Base64 with JDK Base64 for JWT decoding\n\nJWT tokens encode their header and payload using Base64URL as defined by\nRFC 7515/7519. The current implementation decodes JWT payloads using\neither org.apache.commons.codec.binary.Base64 or the standard Base64\ndecoder, neither of which implements the URL-safe Base64 variant required\nby the JWT specification. This may silently accept malformed input or\nfail for URL-safe payloads.\n\nReplace existing decoding logic with java.util.Base64.getUrlDecoder(),\nwhich correctly implements Base64URL, and apply the same decoding to\nSAP IAS JWT parsing, which previously used the standard Base64 decoder.\n\nAs part of this change:\n  * Decode JWT payloads using Base64.getUrlDecoder()\n  * Remove reliance on UnsupportedEncodingException by using\n    StandardCharsets.UTF_8 directly\n  * Maintain existing failure semantics for malformed JWT structure,\n    while treating invalid Base64URL payloads as IO failures.\n\nMalformed tokens that were previously accepted due to permissive\ndecoding will now be rejected.\n\nRemove the commons-codec dependency from the oauth plugin entirely.\n\nChange-Id: I033936936bdf88713e9eab604923215b0b57d4a7\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "089ec90711c85cc1756e81c34c8ffaf81bbcb17c",
      "old_mode": 33188,
      "old_path": "BUILD",
      "new_id": "424d36c3d77f655f497f02ed944c10a300c8acd9",
      "new_mode": 33188,
      "new_path": "BUILD"
    },
    {
      "type": "modify",
      "old_id": "db7aafffdd414f88217743fc0b5abb7f3927b108",
      "old_mode": 33188,
      "old_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/JsonUtil.java",
      "new_id": "0e20ec4f6c1d11620d1203a979c6a03c25f94a61",
      "new_mode": 33188,
      "new_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/JsonUtil.java"
    },
    {
      "type": "modify",
      "old_id": "6f89662d23d9c25636dd1f35b4ba1b809f73f4d9",
      "old_mode": 33188,
      "old_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/azure/AzureActiveDirectoryService.java",
      "new_id": "41e8107e625766f72d1c3551c482b3a1b7ae63da",
      "new_mode": 33188,
      "new_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/azure/AzureActiveDirectoryService.java"
    },
    {
      "type": "modify",
      "old_id": "4f8e7c83a245ae1094cf29a4920bc51debea49f0",
      "old_mode": 33188,
      "old_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/dex/DexOAuthService.java",
      "new_id": "2248d17df8a3e93eb28cb16673afc7deb805af6f",
      "new_mode": 33188,
      "new_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/dex/DexOAuthService.java"
    },
    {
      "type": "modify",
      "old_id": "2daee21243cc9dc08ebe1ae5514fa4feb95e82d8",
      "old_mode": 33188,
      "old_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/google/GoogleOAuthService.java",
      "new_id": "49a78d6adc24b5ed01b43bace619cb8eda96d589",
      "new_mode": 33188,
      "new_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/google/GoogleOAuthService.java"
    },
    {
      "type": "modify",
      "old_id": "2a06f0630ee2a3187714276a6ae4f6c8b1f1e8ee",
      "old_mode": 33188,
      "old_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/keycloak/KeycloakOAuthService.java",
      "new_id": "4bdf501803e01c0ef037676865bbf98714ab75fb",
      "new_mode": 33188,
      "new_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/keycloak/KeycloakOAuthService.java"
    },
    {
      "type": "modify",
      "old_id": "138e1e04ad51ad40248aa4dac15a956197cfaec3",
      "old_mode": 33188,
      "old_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/sap/SAPIasOAuthLoginProvider.java",
      "new_id": "6d2d719c6f8c84074e3c091f314fa88c1abfdf51",
      "new_mode": 33188,
      "new_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/sap/SAPIasOAuthLoginProvider.java"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "9797ef7c81bb47cdaf38fad8a2084e6811c22fc5",
      "new_mode": 33188,
      "new_path": "src/test/java/com/googlesource/gerrit/plugins/oauth/JsonUtilTest.java"
    }
  ]
}