Skip to content

Validate public arguments before model evaluation - #122

Draft
seonghobae wants to merge 4 commits into
masterfrom
sentinel-input-validation-9715049892224118093
Draft

Validate public arguments before model evaluation#122
seonghobae wants to merge 4 commits into
masterfrom
sentinel-input-validation-9715049892224118093

Conversation

@seonghobae

@seonghobae seonghobae commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator

vuongtest()icci()의 공개 인자를 모델 객체 검사보다 먼저 검증합니다.

  • nested, adj, conf.level의 길이·타입·NA·허용 범위를 명시적으로 검사합니다.
  • ll1/ll2, score1/score2, vc1/vc2 콜백 계약을 공개 경계에서 검증합니다.
  • 잘못된 인자가 내부 수학/객체 검사 단계까지 내려가 구현 세부에 따라 달라지는 오류를 내는 대신, 안정적인 사용자 오류와 call. = FALSE 경계를 제공합니다.
  • tests/testthat/test_public_argument_validation.R에서 malformed 인자가 객체 introspection보다 먼저 거절되는지, 오류 메시지와 conditionCall()까지 회귀 검증합니다. 이 테스트는 변경 전 구현에서 해당 공개 경계가 없기 때문에 RED가 되는 회귀 조건을 고정합니다.
  • NEWS 0.5-9에 사용자 가시 validation 계약을 기록해 exported behavior와 release note를 일치시켰습니다 (1f066d8d83a6da6d9814cc4dc0aaa45727812e73). 관련 review thread는 이 repair를 근거로 resolve했습니다.

현재 exact Git head는 886672de1524dcdd46c83f214d34ae521bcd3407입니다. 이는 code-current semantic head 1f066d8d83a6da6d9814cc4dc0aaa45727812e73의 one-parent descendant이고 1f066d8...886672d compare는 files=[]입니다. 따라서 886672d...를 새로운 기능/수리 evidence로 취급하지 않으며 추가 source-neutral retrigger commit도 만들지 않습니다.

현재 exact-head R-CMD-check 33757503197, Security Scan 33757503276, SAST 33757503452, OSV 33757504359, Scorecard 33757503282가 모두 queued입니다. 전체 testthat 성공이나 merge-ready는 주장하지 않으며, unchanged exact Git head의 applicable workflow가 terminal GREEN이고 보호 브랜치 정책 및 독립 review가 충족된 경우에만 병합 대상으로 간주합니다.


PR created automatically by Jules for task 9715049892224118093 started by @seonghobae


Devin Review

Adds explicit type, length, and NA checks to `icci()` and `vuongtest()`
to prevent bypassing error boundaries and leaking internal context.
@google-labs-jules

Copy link
Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

@coderabbitai

coderabbitai Bot commented Sep 3, 2026

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 potential issue.

Devin Review

Comment thread R/icci.R
@seonghobae seonghobae changed the title 🛡️ Sentinel: [MEDIUM] Fix Input validation security improvement Validate public arguments before model evaluation Sep 3, 2026
@seonghobae
seonghobae marked this pull request as draft September 3, 2026 09:18
seonghobae and others added 2 commits September 3, 2026 21:46
Adds explicit type, length, and NA checks to `icci()` and `vuongtest()`
to prevent bypassing error boundaries and leaking internal context.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug priority: medium Normal-priority or P2 work type: bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant