)]}'
{
  "commit": "02b1d94858962bc440a47ddec85abef7cfac5f76",
  "tree": "d84d3a0b081d0f399108841aaf661639872a78ad",
  "parents": [
    "41494467fca22c3bfb47f309d0ac60b03263f018"
  ],
  "author": {
    "name": "Pierre-Charles David",
    "email": "pierre-charles.david@obeo.fr",
    "time": "Thu Apr 15 17:13:53 2021 +0200"
  },
  "committer": {
    "name": "Pierre-Charles David",
    "email": "pierre-charles.david@obeo.fr",
    "time": "Thu Apr 15 21:40:50 2021 +0200"
  },
  "message": "[572885] Disable external resources access when rendering SVGs\n\nSee CVE-2019-17566:\n\n    Apache Batik is vulnerable to server-side request forgery, caused\n    by improper input validation by the \"xlink:href\" attributes. By\n    using a specially-crafted argument, an attacker could exploit this\n    vulnerability to cause the underlying server to make arbitrary GET\n    requests.\n\nCompletely disable access to external resources when rendering SVG\nimages, at least for now.\n\nBug: https://bugs.eclipse.org/bugs/show_bug.cgi?id\u003d572885\nSee-also: https://nvd.nist.gov/vuln/detail/CVE-2019-17566\nChange-Id: I2a1e9e618e2f2e0db1a3a6b362b9631492334dc0\nSigned-off-by: Pierre-Charles David \u003cpierre-charles.david@obeo.fr\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "bfa4cd3b9a996444e9efd48683e220a830bb2e59",
      "old_mode": 33188,
      "old_path": "org.eclipse.gmf.runtime.draw2d.ui.render.awt/src/org/eclipse/gmf/runtime/draw2d/ui/render/awt/internal/svg/ImageTranscoderEx.java",
      "new_id": "dc2620749d983261aac9496d37fb6dfa911e6f9f",
      "new_mode": 33188,
      "new_path": "org.eclipse.gmf.runtime.draw2d.ui.render.awt/src/org/eclipse/gmf/runtime/draw2d/ui/render/awt/internal/svg/ImageTranscoderEx.java"
    }
  ]
}