🛡️ Sentinel: [MEDIUM] Fix DoS 취약점 in readline() regex 검증

.jules/sentinel.md

@@ -2,3 +2,7 @@
 **Vulnerability:** Unvalidated inputs passed to `if()` statements can cause process crashes (`condition has length > 1`) or unexpected coercion vulnerabilities.
 **Learning:** In R, optional boolean parameters that default to `NULL` should be validated using explicit runtime type validation (e.g., `if (!is.null(flag) && (!is.logical(flag) || length(flag) != 1 || is.na(flag)))`).
 **Prevention:** Always implement explicit runtime type validation for optional boolean parameters.
+## 2024-07-16 - DoS risk from weak readline regex validation
+**Vulnerability:** The regex validation for `readline()` inputs in `aFIPC.R` used `^[0-9]+$` which permitted large numbers that could result in coercion failures, unhandled exceptions, and potentially application crashes (Denial of Service).
+**Learning:** `as.integer()` coercions on weakly bounded string lengths can yield `NA` and bypass downstream integer checks, failing conditionals.
+**Prevention:** Bound string validations tightly. Changed the regex pattern to strictly match valid choices: `^[12]$`.

R/aFIPC.R

@@ -141,7 +141,7 @@ autoFIPC <-
       }
       for (attempt in seq_len(3)) {
         n <- readline(prompt = "Is it correct? (1: Yes 2: No) : ")
-        if (grepl("^[0-9]+$", n)) {
+        if (grepl("^[12]$", n)) {
           return(as.integer(n))
         }
       }
@@ -171,7 +171,7 @@ autoFIPC <-
               readline(
                 prompt = "Do you want to use default BILOG-MG priors for oldform Data? (1: Yes 2: No) : "
               )
-            if (grepl("^[0-9]+$", n)) {
+            if (grepl("^[12]$", n)) {
               return(as.integer(n))
             }
           }
@@ -390,7 +390,7 @@ autoFIPC <-
               readline(
                 prompt = "Do you want to use default BILOG-MG priors for newform Data? (1: Yes 2: No) : "
               )
-            if (grepl("^[0-9]+$", n)) {
+            if (grepl("^[12]$", n)) {
               return(as.integer(n))
             }
           }

tests/testthat/test-sentinel-validation.R

@@ -1,4 +1,5 @@
-test_that("autoFIPC validates boolean flags for newformBILOGprior, oldformBILOGprior, and confirmCommonItems", {
+
+test_that("aFIPC::autoFIPC validates boolean flags for newformBILOGprior, oldformBILOGprior, and confirmCommonItems", {
   # newformBILOGprior
   expect_error(
     aFIPC::autoFIPC(
@@ -35,3 +36,30 @@ test_that("autoFIPC validates boolean flags for newformBILOGprior, oldformBILOGp
     "Security Error: confirmCommonItems must be a single non-NA logical value or NULL"
   )
 })
+
+
+test_that("aFIPC::autoFIPC handles DoS via oversized integer in readline using regex validation", {
+  # Mock interactive to return TRUE so we reach readline
+  mockery::stub(aFIPC::autoFIPC, 'interactive', TRUE)
+
+  # Provide inputs that will trigger the first readline for confirmCommonItems
+  # when confirmCommonItems = NULL (the default)
+  newformXData <- data.frame(item1 = c(0,1), item2 = c(1,0))
+  oldformYData <- data.frame(item1 = c(1,0), item2 = c(0,1))
+
+  # Stub readline to return '999999999999999999999' which fails the ^[12]$ strict regex
+  # It will loop 3 times and fail with "Too many invalid common item confirmation attempts"
+  mockery::stub(aFIPC::autoFIPC, 'readline', mockery::mock('999999999999999999999', '999999999999999999999', '999999999999999999999'))
+
+  expect_error(
+    aFIPC::autoFIPC(
+      newformXData = newformXData,
+      oldformYData = oldformYData,
+      newformCommonItemNames = c('item1'),
+      oldformCommonItemNames = c('item1'),
+      confirmCommonItems = NULL,
+      itemtype = 'Rasch'
+    ),
+    "Too many invalid common item confirmation attempts"
+  )
+})