Snider/Mining
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ax(ueps): replace code-restatement comment with semantic explanation
Some checks failed
Test / test (push) Waiting to run
Details
Security Scan / security (push) Has been cancelled
Details

Browse source 
The default switch-case comment in ReadAndVerify restated the three
lines immediately following it verbatim, violating AX Principle 2
(comments as usage examples, not code descriptions). Replaced with a
single line explaining the security intent of the behaviour.

Co-Authored-By: Charon <charon@lethean.io>
This commit is contained in:
Claude 2026-04-02 10:58:52 +01:00
parent 2a5a3d6393
commit b64ce31f69
No known key found for this signature in database
GPG key ID: AF404715446AEB41
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkg/ueps/reader.go
View file

@ -85,7 +85,7 @@ func ReadAndVerify(reader *bufio.Reader, sharedSecret []byte) (*ParsedPacket, er
case TagHMAC:
hmacSignature = tagValue
default:
// signedData.WriteByte(tagType); signedData.WriteByte(tagValueLength); signedData.Write(tagValue) — unknown tags contribute to HMAC, blocking injection
// unknown tags contribute to HMAC coverage, blocking tag-injection attacks
signedData.WriteByte(tagType)
signedData.WriteByte(tagValueLength)
signedData.Write(tagValue)