fix: gosec incorrectly warns about accessing signature[64] (#2222)

hf · web-flow · commit bca66268dc4f · 2025-10-20T16:25:41.000+02:00
Incorrectly identifies `[64]` as out-of-bounds access.
diff --git a/internal/utilities/siwe/parser.go b/internal/utilities/siwe/parser.go
@@ -219,8 +219,9 @@ func (m *SIWEMessage) VerifySignature(signatureHex string) bool {
 	copy(signature, sig)
 
 	// Normalize V if needed
+	// #nosec G602
 	if signature[64] >= 27 {
-		signature[64] -= 27
+		signature[64] -= 27 // #nosec G602
 	}
 
 	hash := accounts.TextHash([]byte(m.Raw))

Original file line number	Diff line number	Diff line change
`@@ -219,8 +219,9 @@ func (m *SIWEMessage) VerifySignature(signatureHex string) bool {`
`219`	`219`	`copy(signature, sig)`
`220`	`220`
`221`	`221`	`// Normalize V if needed`
	`222`	`+ // #nosec G602`
`222`	`223`	`if signature[64] >= 27 {`
`223`		`- signature[64] -= 27`
	`224`	`+ signature[64] -= 27 // #nosec G602`
`224`	`225`	`}`
`225`	`226`
`226`	`227`	`hash := accounts.TextHash([]byte(m.Raw))`