🛡️ Sentinel: [MEDIUM] Fix Information Disclosure via Unvalidated Inputs

[seonghobae]

🚨 Severity: MEDIUM
💡 Vulnerability: Publicly exported functions icci() and vuongtest() did not validate user inputs (conf.level, nested, adj). Invalid inputs like NA or incorrect types bypassed top-level safeguards, triggering raw R errors deep inside the codebase (e.g., missing value where TRUE/FALSE needed inside if(nested)).
🎯 Impact: These deep internal errors exposed the execution stack and internal state details to users, which is a form of information disclosure.
🔧 Fix: Added strict type, length, and bounds validation for conf.level, nested, and adj at the very beginning of the functions, using stop(..., call. = FALSE) to fail securely without exposing internal context.
✅ Verification: Ran R CMD INSTALL . and verified that providing invalid arguments to icci() and vuongtest() now immediately yields a safe error message without a stack trace. Tests pass successfully.

---

PR created automatically by Jules for task 389125538685557594 started by @seonghobae

---

Summary by CodeRabbit

• 버그 수정

  • icci()의 신뢰수준 입력값이 단일 숫자이며 유효 범위인지 검증합니다.
  • vuongtest()의 nested 및 adj 입력값을 검증하고, 잘못된 값에는 명확한 오류를 표시합니다.
  • 유효하지 않은 입력으로 인한 예기치 않은 정보 노출 가능성을 줄였습니다.

• 문서

  • 입력값 검증 및 안전한 오류 처리 지침을 추가했습니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 383a887f-375f-441a-8d09-6a61fd4bc7f7

📥 Commits

Reviewing files that changed from the base of the PR and between 807e940 and 09df4d1.

📒 Files selected for processing (3)

• .jules/sentinel.md
• R/icci.R
• R/vuongtest.R

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

icci()와 vuongtest()가 공개 함수 초기 단계에서 입력값을 검증합니다. 잘못된 입력은 명시적 오류로 처리합니다. 관련 취약점과 예방책을 .jules/sentinel.md에 기록했습니다.

Changes

공개 함수 입력 검증

Layer / File(s)	Summary
공개 함수 입력 검증 .jules/sentinel.md, R/icci.R, R/vuongtest.R	icci()는 conf.level의 타입, 길이, 결측값, 범위를 검증합니다. vuongtest()는 nested와 adj의 타입, 길이, 결측값, 허용값을 검증합니다. 관련 오류 처리 지침을 기록합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 09df4

The PR adds localized validation for exported function inputs and reports safe failures with passing checks; no actionable merge-blocking risk remains beyond normal review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 공개 함수의 검증되지 않은 입력으로 발생하는 정보 노출 문제를 수정한다는 주요 변경 사항을 정확하게 요약합니다. 제목은 구체적이고 간결합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel-input-validation-389125538685557594

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

📝 Info: adj now validated even when nested=TRUE

Docs state adj is ignored when nested=TRUE, but the new check at vuongtest.R rejects invalid adj regardless of nested. A call like vuongtest(m1, m2, nested=TRUE, adj=<junk>) that previously ran now errors. Likely intended, noted for awareness.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Verified successor closure into canonical #126 exact 5a4be4cc5e231dc14155b611b4396ec631d5083a. This PR's valid product delta is the same early scalar/type/missingness/domain admission for conf.level, nested, and adj with controlled call.=FALSE errors; the third changed path is generated branch-local .jules/sentinel.md. #126 retains the validation boundary and strengthens it with persistent exported-boundary regressions for zero-length/non-scalar/NA/NaN/infinite/wrong-type/boundary inputs and exact no-call error behavior. The generated Sentinel doctrine is intentionally not inherited as repository authority. No stale checks/reviews transfer. Closing only under complete valid semantic/contract succession; #126 remains Draft.

[google-labs-jules]

Verified successor closure into canonical #126 exact 5a4be4cc5e231dc14155b611b4396ec631d5083a. This PR's valid product delta is the same early scalar/type/missingness/domain admission for conf.level, nested, and adj with controlled call.=FALSE errors; the third changed path is generated branch-local .jules/sentinel.md. #126 retains the validation boundary and strengthens it with persistent exported-boundary regressions for zero-length/non-scalar/NA/NaN/infinite/wrong-type/boundary inputs and exact no-call error behavior. The generated Sentinel doctrine is intentionally not inherited as repository authority. No stale checks/reviews transfer. Closing only under complete valid semantic/contract succession; #126 remains Draft.

Understood. Acknowledging that this work is now obsolete and superseded by #126, stopping work on this task.