Skip to content

πŸ›‘οΈ Sentinel: [HIGH] Fix DoS vulnerability in readline integer coercion #235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 4 commits into from
+12 βˆ’4
Closed

πŸ›‘οΈ Sentinel: [HIGH] Fix DoS vulnerability in readline integer coercion #235

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
827cb70
πŸ›‘οΈ Sentinel: [HIGH] Fix DoS vulnerability in readline integer coercion
seonghobae Aug 10, 2026
ca303fb
πŸ›‘οΈ Sentinel: [HIGH] Fix DoS vulnerability in readline integer coercion
seonghobae Aug 10, 2026
1327ec6
πŸ›‘οΈ Sentinel: [HIGH] Fix DoS vulnerability in readline integer coercion
seonghobae Aug 10, 2026
13fd2e4
πŸ›‘οΈ Sentinel: [HIGH] Fix DoS vulnerability in readline integer coercion
seonghobae Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .Rbuildignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,3 +22,6 @@
^\.jules(/.*)?$
^\.trivyignore\.yaml$
^trivy\.yaml$
^\.semgrepignore$
^test_dummy\.R$
^test_validation\.R$
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,8 @@
**Vulnerability:** Unvalidated inputs passed to `if()` statements can cause process crashes (`condition has length > 1`) or unexpected coercion vulnerabilities.
**Learning:** In R, optional boolean parameters that default to `NULL` should be validated using explicit runtime type validation (e.g., `if (!is.null(flag) && (!is.logical(flag) || length(flag) != 1 || is.na(flag)))`).
**Prevention:** Always implement explicit runtime type validation for optional boolean parameters.

## 2024-07-26 - Strict bounded regex for interactive inputs
**Vulnerability:** Weak regex like `^[0-9]+$` on interactive `readline` inputs allows large integers to be entered, which coerce to `NA` in `as.integer()`, bypassing subsequent logic and causing unhandled exceptions or DoS vulnerabilities.
**Learning:** Using strictly bounded regex, like `^[12]$`, prevents parsing errors and protects the program flow from unexpected user input.
**Prevention:** Always validate interactive inputs with exact bounded regex before coercion.
2 changes: 1 addition & 1 deletion AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ Applies to every agent (Claude, Codex, Cursor, opencode, ...) working in this re
its `private-key` suppression path-scoped in `.trivyignore.yaml` and do not
blanket-ignore the rule.
- A local `trivy` scan with a stale DB misses findings: run
`trivy --download-db-only` first, and scan the **merge ref**, not just the PR head.
`trivy --download-db-only` first, and scan the **merge ref**, not the PR head.

@coderabbitai coderabbitai Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ”’ Security & Privacy | 🟑 Minor | ⚑ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n -C 6 'trivy|refs/pull|merge|checkout' .github AGENTS.md

Repository: ContextualWisdomLab/aFIPC

Length of output: 4930

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- AGENTS.md relevant section ---\n'
sed -n '50,80p' AGENTS.md

printf '\n--- workflow files ---\n'
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
  [ -f "$f" ] && printf '\n### %s\n' "$f" && sed -n '1,160p' "$f"
done

printf '\n--- trivy-related references ---\n'
rg -n -C 3 'trivy|pull_request|base_ref|head_ref|merge|checkout|working-directory|run:' .github/workflows AGENTS.md .trivyignore.yaml trivy.yaml 2>/dev/null || true

printf '\n--- workflow checkout options text ---\n'
rg -n -C 4 'actions/checkout|checkout@|ref:|repository:|ref:' .github/workflows || true

Repository: ContextualWisdomLab/aFIPC

Length of output: 254

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- AGENTS.md relevant section ---'
sed -n '50,80p' AGENTS.md

printf '%s\n' ''
printf '%s\n' '--- workflow files ---'
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
  if [ -f "$f" ]; then
    printf '%s\n' ""
    printf '%s\n' "### $f"
    sed -n '1,180p' "$f"
  fi
done

printf '%s\n' ''
printf '%s\n' '--- trivy-related references ---'
rg -n -C 3 'trivy|pull_request|base_ref|head_ref|merge|checkout|working-directory|run:' .github/workflows AGENTS.md .trivyignore.yaml trivy.yaml 2>/dev/null || true

printf '%s\n' ''
printf '%s\n' '--- workflow checkout options text ---'
rg -n -C 4 'actions/checkout|checkout@|ref:|repository:|ref:' .github/workflows || true

Repository: ContextualWisdomLab/aFIPC

Length of output: 14875

local trivy fs μ‹€ν–‰ μ „ merge ref checkout 절차λ₯Ό ν‘œμ‹œν•˜μ„Έμš”.

AGENTS.md:73μ—μ„œ merge refλ₯Ό μŠ€μΊ” λŒ€μƒμ΄λΌκ³  λͺ…μ‹œν–ˆμ§€λ§Œ, ν˜„μž¬ μ§€μΉ¨μ—λŠ” git fetch origin refs/pull/<number>/merge/gh pr checkout <number> λ˜λŠ” 같은 효과λ₯Ό λ§Œλ“œλŠ” checkout μ ˆμ°¨κ°€ μ—†μŠ΅λ‹ˆλ‹€. 별도 λ³΄μ•ˆ workflow도 μ—†μ–΄ local μž‘μ—…μ—μ„œ 이 글이 PR headμ—μ„œ μ‹€ν–‰λ˜μ§€ μ•Šλ„λ‘ ν•˜λŠ” λͺ…μ‹œμ  λ™μž‘κ°€μ΄λ“œκ°€ ν•„μš”ν•©λ‹ˆλ‹€.

πŸ€– Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@AGENTS.md` at line 73, Update the local Trivy scanning guidance in AGENTS.md
to include an explicit checkout procedure that fetches and checks out the pull
request merge ref, such as refs/pull/<number>/merge, before running trivy fs.
Ensure the instructions clearly prevent scanning the PR head and retain the
existing trivy --download-db-only step.

- The org `code_scanning` ruleset is intentionally **CodeQL-only** (multiple
code-scanning tools cannot converge on one PR ref). Gating is by the Security
Scan **job result**, not the `code_scanning` rule; do not add tools to that rule.
Expand Down
6 changes: 3 additions & 3 deletions R/aFIPC.R
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ autoFIPC <-
}
for (attempt in seq_len(3)) {
n <- readline(prompt = "Is it correct? (1: Yes 2: No) : ")
if (grepl("^[0-9]+$", n)) {
if (grepl("^[12]$", n)) {
return(as.integer(n))
}
}
Expand Down Expand Up @@ -171,7 +171,7 @@ autoFIPC <-
readline(
prompt = "Do you want to use default BILOG-MG priors for oldform Data? (1: Yes 2: No) : "
)
if (grepl("^[0-9]+$", n)) {
if (grepl("^[12]$", n)) {
return(as.integer(n))
}
}
Expand Down Expand Up @@ -390,7 +390,7 @@ autoFIPC <-
readline(
prompt = "Do you want to use default BILOG-MG priors for newform Data? (1: Yes 2: No) : "
)
if (grepl("^[0-9]+$", n)) {
if (grepl("^[12]$", n)) {
return(as.integer(n))
}
}
Expand Down
Loading