{"push_id":591001526,"size":2,"distinct_size":2,"ref":"refs/heads/master","head":"4974565db1897c8359efe9fa147436c1e3cfa1ab","before":"93cef34eb917deed037e2d7abb34aa9aa4095219","commits":[{"sha":"0fcd111fff64e5dd25ed30d6fab4c7606f89297d","author":{"email":"64b2b6d12bfe4baae7dad3d018f8cbf6b0e7a044@hoffman-andrews.com","name":"Jacob Hoffman-Andrews"},"message":"Fix cookie securing under new style guide.\n\nCookies are only eligible to be secured if a ruleset matches them using\npotentiallyApplicableRulesets. Previously, cookie wildcard domains\n(\".example.com\") happened to match target host wildcards (\"<target\nhost=*.example.com />\") through a quirk in the implementation of\npotentiallyApplicableRulesets.\n\nHowever, the new ruleset style guide recommends against including\ntarget host wildcards unless all subdomains are actually rewritten\nto HTTPS. Under the old quirky behavior, the cookie domain attribute\n\".example.com\" does not match the target host \"example.com\".\n\nThis change clarifies the function of potentiallyApplicableRulesets and modifies\nthe cookie-related functions to strip a leading dot before calling\npotentiallyApplicableRulesets. This restores cookie securing functionality for\ncookies with wildcard domain attributes.","distinct":true,"url":"https://api.github.com/repos/EFForg/https-everywhere/commits/0fcd111fff64e5dd25ed30d6fab4c7606f89297d"},{"sha":"4974565db1897c8359efe9fa147436c1e3cfa1ab","author":{"email":"64b2b6d12bfe4baae7dad3d018f8cbf6b0e7a044@hoffman-andrews.com","name":"jsha"},"message":"Merge pull request #1147 from jsha/better-cookie-securing\n\nFix cookie securing under new style guide.","distinct":true,"url":"https://api.github.com/repos/EFForg/https-everywhere/commits/4974565db1897c8359efe9fa147436c1e3cfa1ab"}]}