🛡️ Sentinel: [MEDIUM] Fix Integer Coercion Vulnerability - #176
🛡️ Sentinel: [MEDIUM] Fix Integer Coercion Vulnerability#176seonghobae wants to merge 4 commits into
Conversation
Fixed weak regex validation for integer conversion via readline() in R/aFIPC.R to prevent DoS or crashes via as.integer() type coercion.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Warning Review limit reached
Next review available in: 2 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthroughautoFIPC와 surveyFA를 패키지 API로 추가하고, 양식별 추정·공통 문항 링킹·실패 복구·결과 산출을 구현했습니다. 패키지 문서와 R check 산출물, 입력 검증 테스트, 대화형 입력 및 빌드 제외 규칙도 갱신했습니다. ChangesFIPC 보정 기능
패키지 배포 산출물
입력 및 빌드 보안 강화
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant autoFIPC
participant surveyFA
participant mirt
Caller->>autoFIPC: old/new 데이터와 공통 문항 전달
autoFIPC->>mirt: 양식별 모델 추정
autoFIPC->>surveyFA: 실패 모델 복구 요청
surveyFA->>mirt: EM/QMCEM/MHRM 재추정
surveyFA-->>autoFIPC: 유효 모델 또는 복구 실패
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
This PR tightens interactive prompt input validation inside autoFIPC() to prevent unsafe as.integer() coercion outcomes (e.g., large numeric strings becoming NA) and documents the security lesson in the Sentinel log.
Changes:
- Restrict interactive prompt acceptance from
^[0-9]+$to the exact allowed options^[12]$for common-item confirmation and BILOG prior selection. - Preserve existing retry/stop behavior for repeated invalid inputs.
- Document the integer-coercion risk and prevention guidance in
.jules/sentinel.md.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| R/aFIPC.R | Hardens readline() option parsing so only 1/2 are accepted before as.integer() conversion in interactive flows. |
| .jules/sentinel.md | Adds a Sentinel entry documenting the coercion pitfall and the bounded-regex mitigation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
… issue Fixed weak regex validation for integer conversion via readline() in R/aFIPC.R to prevent DoS or crashes via as.integer() type coercion. Added `.semgrepignore` to `.Rbuildignore` to fix `R CMD check` CI failure regarding unrecognized hidden files.
… issue Fixed weak regex validation for integer conversion via readline() in R/aFIPC.R to prevent DoS or crashes via as.integer() type coercion. Added `.semgrepignore` to `.Rbuildignore` to fix `R CMD check` CI failure regarding unrecognized hidden files. Removed `test_dummy.R` and `test_validation.R` from the top level which were failing the check `R CMD check` due to non-standard files found.
| **Learning:** In R, optional boolean parameters that default to `NULL` should be validated using explicit runtime type validation (e.g., `if (!is.null(flag) && (!is.logical(flag) || length(flag) != 1 || is.na(flag)))`). | ||
| **Prevention:** Always implement explicit runtime type validation for optional boolean parameters. | ||
|
|
||
| ## 2024-07-26 - Integer Coercion Vulnerability from readline() |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 11
🧹 Nitpick comments (7)
aFIPC.Rcheck/aFIPC/R/aFIPC.rdb (1)
1-1: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win생성된 R CMD check 산출물은 저장소에서 제외하세요.
aFIPC.Rcheck/aFIPC/R/aFIPC.rdb는 소스가 아닌 생성 바이너리입니다. 동일한aFIPC.Rcheck/트리의 로그·RDS·도움말 DB·설치 패키지 사본도 함께 제거하고, 검증 결과는 CI 아티팩트로 보관하세요. 그렇지 않으면 저장소 용량과 리뷰 diff가 불필요하게 커지고 결과물이 쉽게 오래됩니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@aFIPC.Rcheck/aFIPC/R/aFIPC.rdb` at line 1, Remove the generated R CMD check artifacts under the aFIPC.Rcheck tree, including aFIPC.rdb and any logs, RDS files, help databases, and installed package copies; ensure the entire generated directory is excluded from version control and retain validation results through CI artifacts instead.aFIPC.Rcheck/aFIPC/Meta/Rd.rds (1)
1-1: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win생성된 RDS 메타데이터를 소스 저장소에 커밋하지 마세요.
aFIPC.Rcheck/aFIPC/Meta/*.rds는 패키지 빌드·체크에서 재생성되는 산출물입니다. 소스나 namespace가 변경되면 stale 상태가 되고 바이너리 diff로 검토하기도 어렵습니다. CI에서 생성하도록 하고 해당 체크 산출물을 버전 관리에서 제외하세요.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@aFIPC.Rcheck/aFIPC/Meta/Rd.rds` at line 1, Remove the generated RDS metadata artifact under aFIPC.Rcheck/aFIPC/Meta from version control and add the corresponding aFIPC.Rcheck build/check output pattern to the repository’s ignore configuration so CI recreates it during package checks.aFIPC.Rcheck/aFIPC-Ex.R (1)
33-41: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift공개 API 예제를 실행 가능한 최소 예제로 제공하세요.
현재 예제는
Not run상태이고 입력 객체도 정의되어 있지 않아 API 계약을 검증하지 못합니다. 최소한의 실행 가능한 toy 입력을 추가하거나, 필요한 모델 생성 절차와 실행 불가 사유를 원본 Rd 문서에 명시한 뒤 산출물을 재생성하세요.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@aFIPC.Rcheck/aFIPC-Ex.R` around lines 33 - 41, autoFIPC 예제를 실행 가능한 최소 예제로 수정하고, new_model·old_model·common_new·common_old 등 필요한 toy 입력과 모델 생성 절차를 포함하세요. 예제를 실제로 실행해 API 계약을 검증할 수 있도록 Not run 상태를 제거하고 산출물을 재생성하며, 실행이 불가능한 경우에는 원본 Rd 문서에 그 사유와 필요한 절차를 명시한 뒤 재생성하세요.aFIPC.Rcheck/tests/testthat/test-fixed-parameter-calibration.R (1)
83-88: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
expect_false(any(...))는 빈 벡터에서도 통과하므로 검증이 무력화될 수 있습니다.
linked_structural이 0-길이면any()가FALSE를 반환해 테스트가 항상 통과합니다. 실제로 g/u 행이 존재하는지 먼저 단언해 주세요.💚 제안 수정
+ expect_gt(length(linked_structural), 0) expect_false(any(linked_structural))같은 패턴이 L104(
expect_false(any(linked_fixed$est)))와 L115에도 있습니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@aFIPC.Rcheck/tests/testthat/test-fixed-parameter-calibration.R` around lines 83 - 88, Update the assertions around linked_structural and the corresponding linked_fixed and L115 checks so they first assert that the filtered g/u rows exist and are non-empty, then verify their est values are false. Ensure empty filtered vectors fail the test instead of allowing expect_false(any(...)) to pass.aFIPC.Rcheck/tests/testthat/test-optimization-equivalence.R (1)
37-50: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win구현을 호출하지 않고 표현식을 복제해 검증하므로 회귀 가드로 동작하지 않습니다.
new_idiom은autoFIPC()내부 코드를 참조하는 것이 아니라 동일한 표현식을 테스트 파일에 다시 적어둔 것입니다. 실제 구현(aFIPC.RL773-774)이 바뀌어도 이 테스트는 계속 통과합니다. 카테고리 수 비교 로직을 내부 헬퍼로 추출해 테스트가 그 헬퍼를 호출하도록 하면 의도한 회귀 방지가 성립합니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@aFIPC.Rcheck/tests/testthat/test-optimization-equivalence.R` around lines 37 - 50, Refactor the category-count logic used by autoFIPC into a shared internal helper, then update both the implementation and this test to call that helper instead of duplicating length(na.omit(unique(x))). Preserve the comparison with the legacy levels(as.factor(x)) expression and the existing expected-value assertions.aFIPC.Rcheck/tests/testthat/test-sentinel-validation.R (1)
1-37: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win이번 PR의 핵심 변경인
^[12]$입력 검증에 대한 커버리지가 없습니다.boolean 플래그 검증은 잘 다루고 있지만, 정작
readline()확인 경로(checkCorrect,checknewformBILOGprior,checkoldformBILOGprior)의 exact-match 동작과 3회 초과 시 중단 동작은 검증되지 않습니다. 최소한 비대화형 세션에서confirmCommonItems = NULL일 때 명확히 중단되는지,confirmCommonItems = FALSE일 때'Please write down pairs correctly'로 중단되는지는 추가할 수 있습니다.제가 해당 테스트 케이스를 작성해 드릴까요?
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@aFIPC.Rcheck/tests/testthat/test-sentinel-validation.R` around lines 1 - 37, Add coverage for the new ^[12]$ input validation in the readline confirmation paths, targeting checkCorrect, checknewformBILOGprior, and checkoldformBILOGprior. Verify exact-match handling and termination after more than three invalid attempts, including non-interactive confirmCommonItems = NULL terminating clearly and confirmCommonItems = FALSE terminating with “Please write down pairs correctly”.aFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-autoFIPC.R (1)
1-25: 🩺 Stability & Availability | 🔵 Trivial | 🏗️ Heavy liftPR의 핵심 보안 수정(
checkCorrect()의 readline 정규식^[0-9]+$→^[12]$) 자체에 대한 회귀 테스트가 없습니다.Line 1-12, 14-25의 테스트는
interactive()가 FALSE일 때 조기에 오류가 발생하는 경로만 검증하며, 실제로 readline 입력을 정규식으로 검증하는 로직(및 3회 실패 시 "Too many invalid common item confirmation attempts" 종료 경로)은 전혀 실행되지 않습니다.interactive()와readline()을 함께 모킹해^[0-9]+$였다면as.integer()오버플로우로NA가 발생했을 큰 수(예:"999999999999")나"abc"같은 입력이 올바르게 거부되는지 직접 검증하는 테스트를 추가하는 것을 권장합니다.다만 base 함수(
interactive,readline)를testthat::local_mocked_bindings()로 모킹하려면 패키지 네임스페이스에 해당 바인딩(예:interactive <- NULL)이 미리 존재해야 하며,local_mocked_bindings()는 testthat 3.1.x에서 실험적으로 도입되어 이후(3.2.0) 안정화되었습니다. 이 파일의library_context는testthat (>= 3.0.0)만 요구한다고 명시하므로, CI에서 실제로 이 기능을 사용할 수 있는 testthat 버전이 설치되는지 확인이 필요합니다.test_that("checkCorrect rejects overflow/non-matching readline input", { local_mocked_bindings( interactive = function() TRUE, readline = function(...) "999999999999", .package = "base" ) expect_error( aFIPC::autoFIPC( newformXData = data.frame(A = 1), oldformYData = data.frame(A = 2), newformCommonItemNames = c('A'), oldformCommonItemNames = c('A') ), "Too many invalid common item confirmation attempts" ) })이 테스트 커버리지를 추가하는 PR을 도와드릴까요, 아니면 이슈로 등록해 드릴까요?
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@aFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-autoFIPC.R` around lines 1 - 25, Extend the tests around autoFIPC to exercise checkCorrect’s interactive readline validation directly, rather than only testing the non-interactive early exit. Mock interactive() and readline() using a testthat version-compatible approach, then verify oversized numeric input such as "999999999999" and non-matching input such as "abc" are rejected and repeated invalid responses reach the "Too many invalid common item confirmation attempts" error; ensure the package’s testthat dependency supports the chosen mocking mechanism.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@aFIPC.Rcheck/00_pkg_src/aFIPC/man/autoFIPC.Rd`:
- Around line 38-48: Roxygen documentation in the source contains the typos “set
the this” and “defalut.” Update the corresponding parameter descriptions in the
roxygen comments for the aFIPC configuration documentation in R/aFIPC.R, then
regenerate the .Rd file instead of editing the generated documentation directly.
In `@aFIPC.Rcheck/00_pkg_src/aFIPC/R/aFIPC.R`:
- Around line 88-91: Restrict the itemtype validation near nItems to accept only
a single value, since downstream scalar conditions in the aFIPC processing flow
(including the checks at lines 166, 189, 385, 408, 607, 657, and 891) do not
support per-item vectors. Update the validation error to require length 1 and
remove the length nItems acceptance path.
- Around line 1-4: aFIPC.Rcheck/ 전체는 R CMD check 산출물이므로 버전 관리에서 제거하세요.
aFIPC.Rcheck/00_pkg_src/aFIPC/R/aFIPC.R(1-4),
aFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-optimization-equivalence.R(1-20),
aFIPC.Rcheck/tests/testthat/test-optimization-equivalence.R(1-20)을 삭제하고
R/aFIPC.R 및 tests/testthat/ 아래 정본만 유지하세요. 재생성을 막기 위해 .gitignore에 *.Rcheck/ 패턴도
추가하세요.
- Around line 627-647: Handle the all-FALSE valid_idx case before constructing
IPDData: when no common items match, skip or return from the IPD generation
block using the existing function behavior. Otherwise, keep IPDItemCount
positive and generate column names from the matched item count without allowing
1:0 to produce invalid names.
- Around line 853-868: Update the forceNormalZeroOne branch to identify MEAN_1
instead of MEAN_11, and apply symmetric est = FALSE and value assignments for
both NewScaleParms and OldScaleParms. Ensure COV_11 remains fixed to 1 and
MEAN_1 is fixed to 0 in both parameter groups.
In `@aFIPC.Rcheck/aFIPC/DESCRIPTION`:
- Line 4: 통일된 정식 버전을 선택한 뒤 DESCRIPTION의 Version과 aFIPC 배너가 동일한 버전을 사용하도록 수정하세요.
특히 DESCRIPTION의 Version: 0.1.0과 aFIPC.R의 배너를 함께 갱신하고, 두 위치의 버전 표기를 일치시키세요.
- Line 11: Update aFIPC.Rcheck/aFIPC/DESCRIPTION:11 to use the simplified GPL-3
license declaration. Update aFIPC.Rcheck/aFIPC/LICENSE:1-2 as needed only if
retaining the file LICENSE reference, replacing the current template text with
the actual GPL-3 license body.
In `@aFIPC.Rcheck/aFIPC/html/00Index.html`:
- Around line 26-27: Update the \description{} content in the source surveyFA.Rd
documentation to describe surveyFA’s actual functionality instead of repeating
the function name, then regenerate the corresponding HTML package index output
so the surveyFA entry uses that description.
In `@aFIPC.Rcheck/aFIPC/html/R.css`:
- Line 127: Update the font-family declaration in the R.css stylesheet to quote
the multi-word “Courier New” font name, while preserving the existing Courier
fallback.
In `@aFIPC.Rcheck/tests/testthat/test-autoFIPC.R`:
- Around line 1-91: Remove the duplicated test-autoFIPC.R artifact under the
aFIPC.Rcheck/ directory from the repository, and remove any other committed R
CMD check output in that directory as applicable. Keep the canonical
tests/testthat/test-autoFIPC.R file unchanged.
In `@aFIPC.Rcheck/tests/testthat/test-surveyFA.R`:
- Around line 61-70: Update the surveyFA exhaustion test to call set.seed()
before generating the rbinom() data, using the established deterministic-test
pattern such as the L3 test. Keep the requested scope focused on
reproducibility; do not alter the dataset shape unless needed to exercise the
autofix repetition path.
---
Nitpick comments:
In `@aFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-autoFIPC.R`:
- Around line 1-25: Extend the tests around autoFIPC to exercise checkCorrect’s
interactive readline validation directly, rather than only testing the
non-interactive early exit. Mock interactive() and readline() using a testthat
version-compatible approach, then verify oversized numeric input such as
"999999999999" and non-matching input such as "abc" are rejected and repeated
invalid responses reach the "Too many invalid common item confirmation attempts"
error; ensure the package’s testthat dependency supports the chosen mocking
mechanism.
In `@aFIPC.Rcheck/aFIPC-Ex.R`:
- Around line 33-41: autoFIPC 예제를 실행 가능한 최소 예제로 수정하고,
new_model·old_model·common_new·common_old 등 필요한 toy 입력과 모델 생성 절차를 포함하세요. 예제를 실제로
실행해 API 계약을 검증할 수 있도록 Not run 상태를 제거하고 산출물을 재생성하며, 실행이 불가능한 경우에는 원본 Rd 문서에 그 사유와
필요한 절차를 명시한 뒤 재생성하세요.
In `@aFIPC.Rcheck/aFIPC/Meta/Rd.rds`:
- Line 1: Remove the generated RDS metadata artifact under
aFIPC.Rcheck/aFIPC/Meta from version control and add the corresponding
aFIPC.Rcheck build/check output pattern to the repository’s ignore configuration
so CI recreates it during package checks.
In `@aFIPC.Rcheck/aFIPC/R/aFIPC.rdb`:
- Line 1: Remove the generated R CMD check artifacts under the aFIPC.Rcheck
tree, including aFIPC.rdb and any logs, RDS files, help databases, and installed
package copies; ensure the entire generated directory is excluded from version
control and retain validation results through CI artifacts instead.
In `@aFIPC.Rcheck/tests/testthat/test-fixed-parameter-calibration.R`:
- Around line 83-88: Update the assertions around linked_structural and the
corresponding linked_fixed and L115 checks so they first assert that the
filtered g/u rows exist and are non-empty, then verify their est values are
false. Ensure empty filtered vectors fail the test instead of allowing
expect_false(any(...)) to pass.
In `@aFIPC.Rcheck/tests/testthat/test-optimization-equivalence.R`:
- Around line 37-50: Refactor the category-count logic used by autoFIPC into a
shared internal helper, then update both the implementation and this test to
call that helper instead of duplicating length(na.omit(unique(x))). Preserve the
comparison with the legacy levels(as.factor(x)) expression and the existing
expected-value assertions.
In `@aFIPC.Rcheck/tests/testthat/test-sentinel-validation.R`:
- Around line 1-37: Add coverage for the new ^[12]$ input validation in the
readline confirmation paths, targeting checkCorrect, checknewformBILOGprior, and
checkoldformBILOGprior. Verify exact-match handling and termination after more
than three invalid attempts, including non-interactive confirmCommonItems = NULL
terminating clearly and confirmCommonItems = FALSE terminating with “Please
write down pairs correctly”.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c63e58ea-be92-44ce-a4fc-178f882b04f1
⛔ Files ignored due to path filters (3)
aFIPC.Rcheck/00check.logis excluded by!**/*.logaFIPC.Rcheck/00install.outis excluded by!**/*.outaFIPC.Rcheck/aFIPC-Ex.pdfis excluded by!**/*.pdf
📒 Files selected for processing (51)
aFIPC.Rcheck/00_pkg_src/aFIPC/DESCRIPTIONaFIPC.Rcheck/00_pkg_src/aFIPC/LICENSEaFIPC.Rcheck/00_pkg_src/aFIPC/NAMESPACEaFIPC.Rcheck/00_pkg_src/aFIPC/R/aFIPC.RaFIPC.Rcheck/00_pkg_src/aFIPC/R/surveyFA.RaFIPC.Rcheck/00_pkg_src/aFIPC/README.mdaFIPC.Rcheck/00_pkg_src/aFIPC/man/autoFIPC.RdaFIPC.Rcheck/00_pkg_src/aFIPC/man/surveyFA.RdaFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat.RaFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-autoFIPC.RaFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-fixed-parameter-calibration.RaFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-optimization-equivalence.RaFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-package-api.RaFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-sentinel-validation.RaFIPC.Rcheck/00_pkg_src/aFIPC/tests/testthat/test-surveyFA.RaFIPC.Rcheck/R_check_bin/RaFIPC.Rcheck/R_check_bin/RscriptaFIPC.Rcheck/aFIPC-Ex.RaFIPC.Rcheck/aFIPC-Ex.RoutaFIPC.Rcheck/aFIPC-Ex.timingsaFIPC.Rcheck/aFIPC/DESCRIPTIONaFIPC.Rcheck/aFIPC/INDEXaFIPC.Rcheck/aFIPC/LICENSEaFIPC.Rcheck/aFIPC/Meta/Rd.rdsaFIPC.Rcheck/aFIPC/Meta/features.rdsaFIPC.Rcheck/aFIPC/Meta/hsearch.rdsaFIPC.Rcheck/aFIPC/Meta/links.rdsaFIPC.Rcheck/aFIPC/Meta/nsInfo.rdsaFIPC.Rcheck/aFIPC/Meta/package.rdsaFIPC.Rcheck/aFIPC/NAMESPACEaFIPC.Rcheck/aFIPC/R/aFIPCaFIPC.Rcheck/aFIPC/R/aFIPC.rdbaFIPC.Rcheck/aFIPC/R/aFIPC.rdxaFIPC.Rcheck/aFIPC/help/AnIndexaFIPC.Rcheck/aFIPC/help/aFIPC.rdbaFIPC.Rcheck/aFIPC/help/aFIPC.rdxaFIPC.Rcheck/aFIPC/help/aliases.rdsaFIPC.Rcheck/aFIPC/help/paths.rdsaFIPC.Rcheck/aFIPC/html/00Index.htmlaFIPC.Rcheck/aFIPC/html/R.cssaFIPC.Rcheck/tests/startup.RsaFIPC.Rcheck/tests/testthat.RaFIPC.Rcheck/tests/testthat.RoutaFIPC.Rcheck/tests/testthat/test-autoFIPC.RaFIPC.Rcheck/tests/testthat/test-fixed-parameter-calibration.RaFIPC.Rcheck/tests/testthat/test-optimization-equivalence.RaFIPC.Rcheck/tests/testthat/test-package-api.RaFIPC.Rcheck/tests/testthat/test-sentinel-validation.RaFIPC.Rcheck/tests/testthat/test-surveyFA.Rtest_dummy.Rtest_validation.R
💤 Files with no reviewable changes (2)
- test_validation.R
- test_dummy.R
… issue Fixed weak regex validation for integer conversion via readline() in R/aFIPC.R to prevent DoS or crashes via as.integer() type coercion. Added `.semgrepignore` to `.Rbuildignore` to fix `R CMD check` CI failure regarding unrecognized hidden files. Removed `test_dummy.R` and `test_validation.R` from the top level and added `aFIPC.Rcheck` to `.gitignore` to fix `R CMD check` due to non-standard files found.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
.jules/sentinel.md:6
- The new sentinel entry is dated 2024-07-26, but this PR is dated 2026-07-26. If this is meant to be a running incident log, the year should match the actual fix date to avoid confusion when auditing security learnings later.
## 2024-07-26 - Integer Coercion Vulnerability from readline()
| } | ||
| for (attempt in seq_len(3)) { | ||
| n <- readline(prompt = "Is it correct? (1: Yes 2: No) : ") | ||
| if (grepl("^[0-9]+$", n)) { | ||
| if (grepl("^[12]$", n)) { | ||
| return(as.integer(n)) | ||
| } |
|
Closing as superseded by #193. Exact head |
Understood. Acknowledging that this work is now superseded by #193 and stopping work on this task. |
🚨 Severity: MEDIUM
💡 Vulnerability: Unbounded input via
readline()coerced withas.integer()when checked against^[0-9]+$. If a very large number is provided,as.integer()yieldsNA, which leads to runtime errors or unhandled exceptions when passing lengths > 1 to conditional logic. This is an unexpected behavior/coercion bug that can be exploited for application DoS.🎯 Impact: Potential application crash/Denial of Service when automating or improperly interacting with prompts.
🔧 Fix: Changed the weak match
^[0-9]+$to exact-bounded selection bounds^[12]$ensuring safety ofas.integer()coercion.✅ Verification: Ran
Rscript -e 'devtools::test()'and coverage tools. Tests passed and coverage is maintained. Recorded critical learning in.jules/sentinel.md.PR created automatically by Jules for task 15724802833890598210 started by @seonghobae
Summary by CodeRabbit