From c8edfee8ae357bca7961f274b7aa1453c12431cf Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 2 Apr 2026 10:04:01 +0100 Subject: [PATCH] ax(ueps): add usage-example comment on default HMAC coverage path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit AX Principle 2 — comments as usage examples. The default switch case in ReadAndVerify silently included unknown extension tags in signedData with no explanation of why; added a concrete comment showing the pattern and the security rationale (tag-injection prevention). Co-Authored-By: Charon --- pkg/ueps/reader.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkg/ueps/reader.go b/pkg/ueps/reader.go index 7227ce7..79be96d 100644 --- a/pkg/ueps/reader.go +++ b/pkg/ueps/reader.go @@ -87,6 +87,8 @@ func ReadAndVerify(reader *bufio.Reader, sharedSecret []byte) (*ParsedPacket, er case TagHMAC: signature = tagValue default: + // Unknown extension tags are included in HMAC coverage to prevent tag-injection attacks. + // signedData.Write(extensionTLV) — forward-compatible: new tags are authenticated, not silently dropped. signedData.WriteByte(tagByte) signedData.WriteByte(byte(tagLength)) signedData.Write(tagValue)