🛡️ Sentinel: [MEDIUM] Fix input validation missing on exported functions by seonghobae · Pull Request #85 · ContextualWisdomLab/nonnest2

seonghobae · 2026-08-13T03:50:56Z

🚨 Severity: MEDIUM
💡 Vulnerability: Missing input validation on exported functions icci and vuongtest.
🎯 Impact: Invalid inputs like non-numerics or missing arguments trigger unhandled base R errors (e.g. non-numeric argument to binary operator or missing value where TRUE/FALSE needed) deep within the internal logic, potentially leaking execution stack or state information.
🔧 Fix: Added strict type and bound checks for conf.level and nested at the very beginning of the functions. These check failure conditions and securely halt execution using stop(..., call. = FALSE).
✅ Verification: Verified that tests pass via R CMD INSTALL . and testthat script runs without error. Tested invalid inputs manually to verify they result in clean generic errors.

PR created automatically by Jules for task 3185216319467007046 started by @seonghobae

Summary by CodeRabbit

버그 수정
- icci()에서 신뢰수준이 0과 1 사이의 단일 숫자인지 검증합니다.
- vuongtest()에서 nested가 유효한 단일 논리값인지 확인합니다.
- 잘못된 입력에는 안전하고 명확한 오류를 표시합니다.
문서
- 함수 입력값 검증 기준과 오류 처리 지침을 보완했습니다.

- Added validation for `conf.level` in `icci` - Added validation for `nested` in `vuongtest` - Ensures inputs fail securely with `call. = FALSE` before causing low-level R errors.

google-labs-jules · 2026-08-13T03:50:57Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

coderabbitai · 2026-08-13T03:51:10Z

📝 Walkthrough

Walkthrough

icci()는 conf.level의 형식과 범위를 검증합니다. vuongtest()는 nested가 단일 논리값인지 검증합니다. 관련 보안 지침은 검증 실패 시 call. = FALSE로 오류를 처리하도록 기록합니다.

Changes

입력 검증

Layer / File(s)	Summary
입력 검증 및 오류 처리 `.jules/sentinel.md`, `R/icci.R`, `R/vuongtest.R`	`icci()`는 유효한 단일 숫자인 `conf.level`만 허용합니다. `vuongtest()`는 단일 논리값인 `nested`만 허용합니다. 유효하지 않은 입력은 오류로 처리합니다. 보안 지침은 `call. = FALSE` 사용을 명시합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to bde98

The PR adds localized input validation for the exported functions, and no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 내보낸 함수의 입력 검증 추가라는 변경의 주요 내용을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch sentinel-input-validation-3185216319467007046

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

R/icci.R (1)
67-69: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

새 입력 검증을 자동 회귀 테스트로 고정하세요.

R/icci.R#L67-L69: conf.level의 NA, 경계값, 잘못된 길이, 잘못된 타입과 conditionCall(err) == NULL을 검증하세요.

R/vuongtest.R#L100-L102: nested의 NA, 잘못된 길이, 잘못된 타입과 conditionCall(err) == NULL을 검증하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@R/icci.R` around lines 67 - 69, R/icci.R 67-69의 conf.level 검증에 대한 자동 회귀 테스트를
추가해 NA, 0·1 경계값, 잘못된 길이와 타입이 오류를 발생시키고 conditionCall(err) == NULL인지 확인하세요.
R/vuongtest.R 100-102의 nested 검증에도 NA, 잘못된 길이와 타입을 테스트하고 동일하게 conditionCall(err)
== NULL을 검증하세요.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@R/icci.R`:
- Around line 67-69: Update the exported function documentation for R/icci.R
lines 67-69 by adding the conf.level input contract to its `@param` entry and
man/icci.Rd: it must be a single non-missing numeric value with 0 < conf.level <
1. Update R/vuongtest.R lines 100-102 and the corresponding `@param` entry and
man/vuongtest.Rd documentation to state that nested must be a single non-missing
logical value.

---

Nitpick comments:
In `@R/icci.R`:
- Around line 67-69: R/icci.R 67-69의 conf.level 검증에 대한 자동 회귀 테스트를 추가해 NA, 0·1
경계값, 잘못된 길이와 타입이 오류를 발생시키고 conditionCall(err) == NULL인지 확인하세요. R/vuongtest.R
100-102의 nested 검증에도 NA, 잘못된 길이와 타입을 테스트하고 동일하게 conditionCall(err) == NULL을
검증하세요.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2f85228d-a56d-46ab-addf-d5e791c15a1f

📥 Commits

Reviewing files that changed from the base of the PR and between 807e940 and bde9874.

📒 Files selected for processing (3)

.jules/sentinel.md
R/icci.R
R/vuongtest.R

coderabbitai · 2026-08-13T03:53:42Z

+  if (!is.numeric(conf.level) || length(conf.level) != 1 || is.na(conf.level) || conf.level <= 0 || conf.level >= 1) {
+    stop("conf.level must be a single numeric value between 0 and 1", call. = FALSE)
+  }


📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

내보낸 함수의 입력 계약을 문서에 동일하게 반영하세요.

R/icci.R#L67-L69: conf.level이 단일 비결측 숫자이며 0 < conf.level < 1이어야 한다는 조건을 @param과 man/icci.Rd에 추가하세요.

R/vuongtest.R#L100-L102: nested가 단일 비결측 논리값이어야 한다는 조건을 @param과 man/vuongtest.Rd에 추가하세요.

📍 Affects 2 files

R/icci.R#L67-L69 (this comment)

R/vuongtest.R#L100-L102

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@R/icci.R` around lines 67 - 69, Update the exported function documentation for R/icci.R lines 67-69 by adding the conf.level input contract to its `@param` entry and man/icci.Rd: it must be a single non-missing numeric value with 0 < conf.level < 1. Update R/vuongtest.R lines 100-102 and the corresponding `@param` entry and man/vuongtest.Rd documentation to state that nested must be a single non-missing logical value.

seonghobae · 2026-08-15T09:54:13Z

Closing as superseded by #84. PR #84 implements the same icci() and vuongtest() exported-boundary validation, and additionally validates adj, rejects zero-length/non-finite inputs, asserts call-free package-owned errors across a regression matrix, and carries the security-history update. Keeping one canonical implementation avoids divergent error contracts and duplicate CI/review work.

google-labs-jules · 2026-08-15T09:55:01Z

Closing as superseded by #84. PR #84 implements the same icci() and vuongtest() exported-boundary validation, and additionally validates adj, rejects zero-length/non-finite inputs, asserts call-free package-owned errors across a regression matrix, and carries the security-history update. Keeping one canonical implementation avoids divergent error contracts and duplicate CI/review work.

Understood. Acknowledging that this PR is superseded by #84 and stopping work on this task.

Add strict input validation to exported functions

bde9874

- Added validation for `conf.level` in `icci` - Added validation for `nested` in `vuongtest` - Ensures inputs fail securely with `call. = FALSE` before causing low-level R errors.

coderabbitai Bot reviewed Aug 13, 2026

View reviewed changes

seonghobae closed this Aug 15, 2026

Navigation Menu

Uh oh!

🛡️ Sentinel: [MEDIUM] Fix input validation missing on exported functions - #85

🛡️ Sentinel: [MEDIUM] Fix input validation missing on exported functions#85
seonghobae wants to merge 1 commit into
masterfrom
sentinel-input-validation-3185216319467007046

seonghobae commented Aug 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

google-labs-jules Bot commented Aug 13, 2026

Uh oh!

coderabbitai Bot commented Aug 13, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Aug 13, 2026

Uh oh!

seonghobae commented Aug 15, 2026

Uh oh!

google-labs-jules Bot commented Aug 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

seonghobae commented Aug 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

google-labs-jules Bot commented Aug 13, 2026

Uh oh!

coderabbitai Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

seonghobae commented Aug 15, 2026

Uh oh!

google-labs-jules Bot commented Aug 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 13, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 13, 2026 •

edited

Loading