diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml index e58bb331..765722f7 100644 --- a/.github/workflows/code-quality.yml +++ b/.github/workflows/code-quality.yml @@ -18,6 +18,12 @@ jobs: uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 with: egress-policy: audit + allowed-endpoints: > + github.com:443 + objects.githubusercontent.com:443 + release-assets.githubusercontent.com:443 + 127.0.0.1:48080 + localhost:48080 - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd @@ -37,8 +43,10 @@ jobs: ACTIONLINT_VERSION="1.7.10" ACTIONLINT_FILE="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" ACTIONLINT_BASE_URL="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}" - curl -sSLo "$ACTIONLINT_FILE" "${ACTIONLINT_BASE_URL}/${ACTIONLINT_FILE}" - curl -sSLo actionlint_checksums.txt "${ACTIONLINT_BASE_URL}/actionlint_${ACTIONLINT_VERSION}_checksums.txt" + curl --retry 5 --retry-connrefused -sSLo "$ACTIONLINT_FILE" \ + "${ACTIONLINT_BASE_URL}/${ACTIONLINT_FILE}" + curl --retry 5 --retry-connrefused -sSLo actionlint_checksums.txt \ + "${ACTIONLINT_BASE_URL}/actionlint_${ACTIONLINT_VERSION}_checksums.txt" grep "$ACTIONLINT_FILE" actionlint_checksums.txt | sha256sum -c - tar -xzf "$ACTIONLINT_FILE" actionlint chmod +x actionlint diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml index 54eef61a..39723443 100644 --- a/.github/workflows/r.yml +++ b/.github/workflows/r.yml @@ -25,6 +25,12 @@ jobs: uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 with: egress-policy: audit + allowed-endpoints: > + github.com:443 + objects.githubusercontent.com:443 + release-assets.githubusercontent.com:443 + 127.0.0.1:48080 + localhost:48080 - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index b6e46e2a..dbb60546 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -18,6 +18,12 @@ jobs: uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 with: egress-policy: audit + allowed-endpoints: > + github.com:443 + objects.githubusercontent.com:443 + release-assets.githubusercontent.com:443 + 127.0.0.1:48080 + localhost:48080 - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd @@ -25,8 +31,10 @@ jobs: - name: Install gitleaks run: | GITLEAKS_FILE="gitleaks_8.24.2_linux_x64.tar.gz" - curl -sSLo "$GITLEAKS_FILE" "https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/$GITLEAKS_FILE" - curl -sSLo gitleaks_checksums.txt "https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/gitleaks_8.24.2_checksums.txt" + curl --retry 5 --retry-connrefused -sSLo "$GITLEAKS_FILE" \ + "https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/$GITLEAKS_FILE" + curl --retry 5 --retry-connrefused -sSLo gitleaks_checksums.txt \ + "https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/gitleaks_8.24.2_checksums.txt" grep "$GITLEAKS_FILE" gitleaks_checksums.txt | sha256sum -c - tar -xzf "$GITLEAKS_FILE" gitleaks chmod +x gitleaks @@ -40,8 +48,10 @@ jobs: ACTIONLINT_VERSION="1.7.10" ACTIONLINT_FILE="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" ACTIONLINT_BASE_URL="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}" - curl -sSLo "$ACTIONLINT_FILE" "${ACTIONLINT_BASE_URL}/${ACTIONLINT_FILE}" - curl -sSLo actionlint_checksums.txt "${ACTIONLINT_BASE_URL}/actionlint_${ACTIONLINT_VERSION}_checksums.txt" + curl --retry 5 --retry-connrefused -sSLo "$ACTIONLINT_FILE" \ + "${ACTIONLINT_BASE_URL}/${ACTIONLINT_FILE}" + curl --retry 5 --retry-connrefused -sSLo actionlint_checksums.txt \ + "${ACTIONLINT_BASE_URL}/actionlint_${ACTIONLINT_VERSION}_checksums.txt" grep "$ACTIONLINT_FILE" actionlint_checksums.txt | sha256sum -c - tar -xzf "$ACTIONLINT_FILE" actionlint chmod +x actionlint diff --git a/.jules/sentinel.md b/.jules/sentinel.md index a8207a48..61ee4344 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -2,3 +2,8 @@ **Vulnerability:** Unvalidated inputs passed to `if()` statements can cause process crashes (`condition has length > 1`) or unexpected coercion vulnerabilities. **Learning:** In R, optional boolean parameters that default to `NULL` should be validated using explicit runtime type validation (e.g., `if (!is.null(flag) && (!is.logical(flag) || length(flag) != 1 || is.na(flag)))`). **Prevention:** Always implement explicit runtime type validation for optional boolean parameters. + +## 2024-08-25 - Fix missing bounded validation for readline inputs +**Vulnerability:** Unbounded numeric regex validation (e.g., `^[0-9]+$`) for `readline()` allows large inputs that coerce to `NA` via `as.integer()`. This causes downstream `if (variable == 1)` conditions to fail with a `missing value where TRUE/FALSE needed` error, resulting in unhandled exception crashes. +**Learning:** When reading integer inputs for binary choices, using bounded exact-match regex like `^[12]$` is necessary to prevent coercion crashes and Denial of Service (DoS) vulnerabilities in interactive environments. +**Prevention:** Always use strict and bounded regex validation for `readline()` input instead of broad numeric matching. diff --git a/DESCRIPTION b/DESCRIPTION index f31d3e1a..c90753c5 100644 --- a/DESCRIPTION +++ b/DESCRIPTION @@ -10,7 +10,7 @@ Description: Automates fixed item parameter linking for test linking under the item response theory paradigm using mirt package estimates. License: GPL-3 | file LICENSE Imports: mirt, methods -Suggests: testthat (>= 3.0.0) +Suggests: testthat (>= 3.0.0), mockery Encoding: UTF-8 Config/testthat/edition: 3 Config/roxygen2/version: 8.0.0 diff --git a/R/aFIPC.R b/R/aFIPC.R index 62546519..918e19b1 100644 --- a/R/aFIPC.R +++ b/R/aFIPC.R @@ -141,7 +141,7 @@ autoFIPC <- } for (attempt in seq_len(3)) { n <- readline(prompt = "Is it correct? (1: Yes 2: No) : ") - if (grepl("^[0-9]+$", n)) { + if (grepl("^[12]$", n)) { return(as.integer(n)) } } @@ -171,7 +171,7 @@ autoFIPC <- readline( prompt = "Do you want to use default BILOG-MG priors for oldform Data? (1: Yes 2: No) : " ) - if (grepl("^[0-9]+$", n)) { + if (grepl("^[12]$", n)) { return(as.integer(n)) } } @@ -390,7 +390,7 @@ autoFIPC <- readline( prompt = "Do you want to use default BILOG-MG priors for newform Data? (1: Yes 2: No) : " ) - if (grepl("^[0-9]+$", n)) { + if (grepl("^[12]$", n)) { return(as.integer(n)) } } diff --git a/tests/testthat/test-sentinel-validation.R b/tests/testthat/test-sentinel-validation.R index 900f0ee3..b38d275a 100644 --- a/tests/testthat/test-sentinel-validation.R +++ b/tests/testthat/test-sentinel-validation.R @@ -1,7 +1,7 @@ test_that("autoFIPC validates boolean flags for newformBILOGprior, oldformBILOGprior, and confirmCommonItems", { # newformBILOGprior expect_error( - aFIPC::autoFIPC( + autoFIPC( newformXData = data.frame(A=1), oldformYData = data.frame(A=2), newformCommonItemNames = c('A'), @@ -13,7 +13,7 @@ test_that("autoFIPC validates boolean flags for newformBILOGprior, oldformBILOGp # oldformBILOGprior expect_error( - aFIPC::autoFIPC( + autoFIPC( newformXData = data.frame(A=1), oldformYData = data.frame(A=2), newformCommonItemNames = c('A'), @@ -25,7 +25,7 @@ test_that("autoFIPC validates boolean flags for newformBILOGprior, oldformBILOGp # confirmCommonItems expect_error( - aFIPC::autoFIPC( + autoFIPC( newformXData = data.frame(A=1), oldformYData = data.frame(A=2), newformCommonItemNames = c('A'), @@ -35,3 +35,23 @@ test_that("autoFIPC validates boolean flags for newformBILOGprior, oldformBILOGp "Security Error: confirmCommonItems must be a single non-NA logical value or NULL" ) }) + +test_that("large numbers do not cause NA coercion errors in autoFIPC readline prompt", { + + # Give a huge number that passes ^[0-9]+$ but fails as.integer() + # Then give a valid '2' to continue if it rejects the first one + m <- mockery::mock("999999999999999999999999999999", "2", "2", "2") + mockery::stub(autoFIPC, 'readline', m) + mockery::stub(autoFIPC, 'interactive', TRUE) + + # Check that it rejects the large number correctly by prompting again (which gives 2) and thus stopping + expect_error({ + autoFIPC( + newformXData = data.frame(A=c(1,0,1,0), B=c(1,1,0,0)), + oldformYData = data.frame(A=c(1,0,1,0), B=c(1,1,0,0)), + newformCommonItemNames = c('A'), + oldformCommonItemNames = c('A'), + confirmCommonItems = NULL + ) + }, "Please write down pairs correctly") +})