Language: Go
Label: vulnerable
CWE: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Code:
func (v *V002Entry) Unmarshal(pe models.ProposedEntry) error {
	it, ok := pe.(*models.Intoto)
	if !ok {
		return errors.New("cannot unmarshal non Intoto v0.0.2 type")
	}

	var err error
	if err := types.DecodeEntry(it.Spec, &v.IntotoObj); err != nil {
		return err
	}

	// field validation
	if err := v.IntotoObj.Validate(strfmt.Default); err != nil {
		return err
	}

	if string(v.IntotoObj.Content.Envelope.Payload) == "" {
		return nil
	}

	env := &dsse.Envelope{
		Payload:     string(v.IntotoObj.Content.Envelope.Payload),
		PayloadType: *v.IntotoObj.Content.Envelope.PayloadType,
	}

	allPubKeyBytes := make([][]byte, 0)
	for _, sig := range v.IntotoObj.Content.Envelope.Signatures {
		env.Signatures = append(env.Signatures, dsse.Signature{
			KeyID: sig.Keyid,
			Sig:   string(sig.Sig),
		})

		allPubKeyBytes = append(allPubKeyBytes, sig.PublicKey)
	}

	if _, err := verifyEnvelope(allPubKeyBytes, env); err != nil {
		return err
	}

	v.env = *env

	decodedPayload, err := base64.StdEncoding.DecodeString(string(v.IntotoObj.Content.Envelope.Payload))
	if err != nil {
		return fmt.Errorf("could not decode envelope payload: %w", err)
	}

	h := sha256.Sum256(decodedPayload)
	v.IntotoObj.Content.PayloadHash = &models.IntotoV002SchemaContentPayloadHash{
		Algorithm: swag.String(models.IntotoV002SchemaContentPayloadHashAlgorithmSha256),
		Value:     swag.String(hex.EncodeToString(h[:])),
	}

	return nil
}