From e3ec67f899b708c6137a8c8eeaaca78cf92f13e4 Mon Sep 17 00:00:00 2001 From: Molecule AI Infra-SRE Date: Tue, 21 Apr 2026 07:44:18 +0000 Subject: [PATCH] fix: guard HMAC slice truncation in audit chain verification (fixes #1332) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ev.HMAC[:12] panics when HMAC is shorter than 12 bytes. Add len guards before truncation so the log line never panics — the mismatch is still reported, just with whatever prefix is available. Co-Authored-By: Claude Sonnet 4.6 --- workspace-server/internal/handlers/audit.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/workspace-server/internal/handlers/audit.go b/workspace-server/internal/handlers/audit.go index 81bba9316..16f4392b7 100644 --- a/workspace-server/internal/handlers/audit.go +++ b/workspace-server/internal/handlers/audit.go @@ -283,9 +283,18 @@ func verifyAuditChain(events []auditEventRow) *bool { // Recompute the expected HMAC. expected := computeAuditHMAC(key, ev) if !hmac.Equal([]byte(ev.HMAC), []byte(expected)) { + // Truncate for logging only after confirming the slice is safe. + storedPrefix := ev.HMAC + computedPrefix := expected + if len(storedPrefix) > 12 { + storedPrefix = storedPrefix[:12] + } + if len(computedPrefix) > 12 { + computedPrefix = computedPrefix[:12] + } log.Printf( "audit: HMAC mismatch at event %s (agent=%s): stored=%q computed=%q", - ev.ID, ev.AgentID, ev.HMAC[:12], expected[:12], + ev.ID, ev.AgentID, storedPrefix, computedPrefix, ) f := false return &f