dgryski.semgrep-go.hmac-bytes.use-hmac-equal

rules:
  - id: use-hmac-equal
    patterns:
      - pattern-either:
          - pattern: |
              $MAC = hmac.New(...)
              ...
              $H = $MAC.Sum(...)
              ...
              bytes.Equal($H, ...)
          - pattern: |
              $MAC = hmac.New(...)
              ...
              $H = $MAC.Sum(...)
              ...
              bytes.Equal(..., $H)
    message: Comparing a MAC with bytes.Equal()
    languages:
      - go
    severity: ERROR
    metadata:
      license: MIT