🛡️ Sentinel: [MEDIUM] Add input validation to exported functions to fail securely

[seonghobae]

🚨 Severity: MEDIUM
💡 Vulnerability: Missing strict input validation on the adj and nested arguments in vuongtest() and the conf.level argument in icci(). This allows unvalidated inputs to propagate into internal functions, which can cause unexpected raw errors, malformed outputs (like NaN confidence bounds), and stack trace leakage revealing internal execution context.
🎯 Impact: An attacker or user could exploit this to crash the application unexpectedly or glean information about the internal execution environment by observing deep stack traces.
🔧 Fix: Added strict type, length, missingness (is.na), and bounds checking for these user-facing arguments at the beginning of the exported functions. All validation failures are caught immediately and handled securely using stop(..., call. = FALSE) to ensure no internal context is leaked.
✅ Verification: Ran sudo R CMD INSTALL . and testthat::test_dir('tests/testthat'). Tests pass cleanly. Manually verified that invalid inputs (e.g. adj=c('aic', 'bic') or conf.level=1.5) now fail immediately and securely.

---

PR created automatically by Jules for task 2862550611212438708 started by @seonghobae

---

Summary by CodeRabbit

• 버그 수정

  • 신뢰구간 수준(conf.level)이 0과 1 사이의 단일 숫자인지 검증합니다.
  • nested 및 adj 입력값의 형식과 허용 범위를 확인합니다.
  • 잘못된 입력에 대해 내부 오류나 스택 트레이스 대신 명확한 오류 메시지를 표시합니다.

• 문서

  • 사용자 입력 검증 및 안전한 오류 처리에 관한 보안 지침을 추가했습니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d8077159-cf2d-46a7-8465-4df4bfaea742

📥 Commits

Reviewing files that changed from the base of the PR and between 807e940 and 9b671ba.

📒 Files selected for processing (3)

• .jules/sentinel.md
• R/icci.R
• R/vuongtest.R

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

icci()와 vuongtest()가 실행 초기에 입력 인자를 검증한다. 유효하지 않은 값이면 호출자 정보를 제외한 오류를 발생시킨다. 관련 보안 학습 내용도 문서에 추가되었다.

Changes

입력 인자 검증

Layer / File(s)	Summary
공개 함수 입력 검증 및 안전한 실패 R/icci.R, R/vuongtest.R, .jules/sentinel.md	icci()는 conf.level의 형식, 길이, NA 여부 및 범위를 검증한다. vuongtest()는 nested와 adj의 형식, 길이, NA 여부 및 허용값을 검증한다. 잘못된 입력에는 call. = FALSE를 적용한 명시적 오류를 사용한다. 관련 보안 학습 내용을 문서화한다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 9b671

The change adds localized validation so invalid arguments fail early without exposing internal call context; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 내보낸 함수에 입력 검증을 추가하고 안전하게 실패하도록 변경한 주요 내용을 정확하게 요약합니다. 이 변경은 PR의 목적 및 실제 수정 내용과 일치합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel/input-validation-2862550611212438708

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

📝 Info: adj now errors on previously-tolerated inputs

The old code compared adj only against "aic"/"bic", so any other value silently acted as "none". The strict check now errors on such inputs, a behavior change for callers that passed unexpected adj values.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Verified successor closure: canonical option-validation PR #126 now has exact head 5a4be4cc5e231dc14155b611b4396ec631d5083a. Normal two-parent commit 5a4be4cc... records this PR's exact head 9b671ba6452b44e65c141ff574626cc0f957b78e as an ancestor without rewriting history. Fresh comparison is ahead 19 / behind 0 from #108 to #126. #126 retains the early nested / adj / conf.level admission behavior and strengthens it with persistent zero-length/non-scalar/NA/NaN/infinite/wrong-type/boundary regressions plus fixed conditionCall()==NULL error-shape evidence. The only omitted #108 delta is branch-local .jules/sentinel.md, intentionally rejected because it is not protected repository authority. No check/review result is transferred. Closing only as verified complete valid-delta succession; #126 remains Draft and must acquire fresh exact-head gates/review.

[google-labs-jules]

Verified successor closure: canonical option-validation PR #126 now has exact head 5a4be4cc5e231dc14155b611b4396ec631d5083a. Normal two-parent commit 5a4be4cc... records this PR's exact head 9b671ba6452b44e65c141ff574626cc0f957b78e as an ancestor without rewriting history. Fresh comparison is ahead 19 / behind 0 from #108 to #126. #126 retains the early nested / adj / conf.level admission behavior and strengthens it with persistent zero-length/non-scalar/NA/NaN/infinite/wrong-type/boundary regressions plus fixed conditionCall()==NULL error-shape evidence. The only omitted #108 delta is branch-local .jules/sentinel.md, intentionally rejected because it is not protected repository authority. No check/review result is transferred. Closing only as verified complete valid-delta succession; #126 remains Draft and must acquire fresh exact-head gates/review.

Understood. Acknowledging that this work is now obsolete and stopping work on this task. The PR is closed as verified complete valid-delta succession in favor of PR #126.