From 09e5f9cae9d39d985f706d0bf40d935f1ddd28a6 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 1 Sep 2026 04:26:24 +0000
Subject: [PATCH 1/4] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20m?=
 =?UTF-8?q?issing=20input=20validation=20in=20exported=20functions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added strict input validation for `conf.level` in `icci()` and `nested`, `adj` in `vuongtest()` to fail securely and prevent information leakage via raw R errors on invalid types or bounds.
---
 .jules/sentinel.md | 4 ++++
 R/icci.R           | 4 ++++
 R/vuongtest.R      | 7 +++++++
 3 files changed, 15 insertions(+)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index bc5c6e1..4c40b97 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -12,3 +12,7 @@
 **Vulnerability:** Raw `stop()` and `warning()` calls without `call. = FALSE` in `llcont.R` and `vuongtest.R` exposed execution stack/call details when raised.
 **Learning:** While some instances of `stop()` inside `tryCatch()` were previously fixed to hide the call stack, other standalone exceptions and warnings still leaked call context. Security must be consistently applied across the entire codebase.
 **Prevention:** Always set `call. = FALSE` when using `stop()` or `warning()` to enforce a secure-by-default boundary and prevent internal execution paths from being disclosed to the end user.
+## 2024-05-14 - [Input Validation for Type Safety and Security]
+**Vulnerability:** Unvalidated inputs in exported functions (`vuongtest`'s `nested`, `adj` and `icci`'s `conf.level`) allow execution to reach deeper internal code branches with invalid types (e.g., NA for `nested` causing "missing value where TRUE/FALSE needed" inside `if(nested)`).
+**Learning:** In R, missing early type and bounds checks can leak internal execution stack paths via uncaught exceptions from standard internal operations. Short-circuit operators (`||`) must be used carefully with type and length checks before value comparisons.
+**Prevention:** Implement strict input validation (`is.logical`, `is.numeric`, bounds checking) at the absolute beginning of all exported interface functions, paired with `stop(..., call. = FALSE)` to fail securely before processing begins.
diff --git a/R/icci.R b/R/icci.R
index f22278a..b5358ce 100644
--- a/R/icci.R
+++ b/R/icci.R
@@ -65,6 +65,10 @@
 #' @export
 icci <- function(object1, object2, conf.level=.95, ll1=llcont, ll2=llcont) {
 
+  if (!is.numeric(conf.level) || length(conf.level) != 1 || is.na(conf.level) || conf.level <= 0 || conf.level >= 1) {
+    stop("conf.level must be a single numeric value between 0 and 1", call. = FALSE)
+  }
+
   ## check objects, issue warnings/errors, get classes/calls
   obinfo <- check.obj(object1, object2)
   callA <- obinfo$callA; classA <- obinfo$classA
diff --git a/R/vuongtest.R b/R/vuongtest.R
index 2bdfbf6..8fc3d19 100644
--- a/R/vuongtest.R
+++ b/R/vuongtest.R
@@ -98,6 +98,13 @@
 #' @export
 vuongtest <- function(object1, object2, nested=FALSE, adj="none", ll1=llcont, ll2=llcont, score1=NULL, score2=NULL, vc1=vcov, vc2=vcov) {
 
+  if (!is.logical(nested) || length(nested) != 1 || is.na(nested)) {
+    stop("nested must be a single logical value", call. = FALSE)
+  }
+  if (!is.character(adj) || length(adj) != 1 || is.na(adj) || !(adj %in% c("none", "aic", "bic"))) {
+    stop("adj must be 'none', 'aic', or 'bic'", call. = FALSE)
+  }
+
   ## check objects, issue warnings/errors, get classes/calls
   obinfo <- check.obj(object1, object2)
   callA <- obinfo$callA; classA <- obinfo$classA

From c058a1bfcbf09c63974b9fb0c5e2808a1b1b03fc Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 1 Sep 2026 08:18:44 +0000
Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20m?=
 =?UTF-8?q?issing=20input=20validation=20in=20exported=20functions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added strict input validation for `conf.level` in `icci()` and `nested`, `adj` in `vuongtest()` to fail securely and prevent information leakage via raw R errors on invalid types or bounds.

From 849774a4587c11f65f0b4402984bf52ce001f4ed Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Wed, 2 Sep 2026 19:29:36 +0000
Subject: [PATCH 3/4] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20m?=
 =?UTF-8?q?issing=20input=20validation=20in=20exported=20functions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added strict input validation for `conf.level` in `icci()` and `nested`, `adj` in `vuongtest()` to fail securely and prevent information leakage via raw R errors on invalid types or bounds.

From 7a4eb8614c30b2d987c64a8835172fa02148e4f6 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 3 Sep 2026 08:58:44 +0000
Subject: [PATCH 4/4] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20m?=
 =?UTF-8?q?issing=20input=20validation=20in=20exported=20functions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added strict input validation for `conf.level` in `icci()` and `nested`, `adj` in `vuongtest()` to fail securely and prevent information leakage via raw R errors on invalid types or bounds.