GitLab Duo commented on merge request !5 at Bluefly.io / OssA / Lab / GITLAB OpenStandardAgent

GitLab Duo
2026-03-28T10:52:43Z

The ExternalControlSignature function concatenates timestamp, nonce, and status with dots, but this could potentially lead to signature confusion if any of these values contain dots. Consider using a more robust serialization format or escaping dots in the input values.

func ExternalControlSignature(secret, timestamp, nonce, status string) string {
mac := hmac.New(sha256.New, []byte(secret))
// Use length-prefixed format to prevent signature confusion
data := fmt.Sprintf("%d:%s%d:%s%d:%s", len(timestamp), timestamp, len(nonce), nonce, len(status), status)
mac.Write([]byte(data))
return hex.EncodeToString(mac.Sum(nil))
}