🛡️ Sentinel: [MEDIUM] 대화형 입력값 검증 강화를 통한 정수 오버플로우 방지

[seonghobae]

🚨 Severity: MEDIUM

💡 Vulnerability

aFIPC.R의 대화형 프롬프트 입력 처리 과정에서 사용자의 입력을 검증할 때, 길이에 제한을 두지 않는 정규표현식(^[0-9]+$)을 사용하고 있었습니다. 이로 인해 극단적으로 긴 숫자 문자열(예: 99999999999...)이 입력될 경우, 정규표현식 검증은 통과하지만 이후 as.integer() 함수를 거치며 정수 오버플로우(Integer overflow coercion)로 인해 강제로 NA 값으로 변환되는 취약점이 있었습니다.

🎯 Impact

사용자의 악의적/실수적인 대형 정수 입력으로 인해 내부 로직에서 의도치 않게 NA 값이 반환 및 처리될 수 있으며, 이는 다운스트림 로직 실패나 패키지 프로세스 충돌(Crash/Denial of Service 위험성)을 일으킬 가능성이 존재합니다.

🔧 Fix

입력된 값을 검증하는 로직을 포괄적인 숫자형태(^[0-9]+$)에서 명시적으로 허용된 메뉴 옵션인 1 또는 2 (^[12]$)만 정확하게 일치하도록 변경하였습니다. 이를 통해 허용되지 않은 입력은 올바르게 거부되고 재시도를 요청하는 본래의 폴백(Fallback) 로직이 정상적으로 작동합니다. 또한 해당 보안 강화 내역을 .jules/sentinel.md에 문서화 하였습니다.

✅ Verification

변경사항 적용 후 전체 패키지 테스트 스위트(testthat)를 구동하여 정상 동작과 어떠한 회귀 이슈(Regression)도 없음을 확인하였습니다 ([ FAIL 0 | WARN 0 | SKIP 0 | PASS 55 ]).

---

PR created automatically by Jules for task 2458567275298918624 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[seonghobae]

Current-HEAD 보강 완료: 66665fd98991228229de393c6bf3ebc74f0d3194

• 허용 입력을 단일 문자 1/2로 제한하는 내부 경계 검증을 세 대화형 프롬프트가 공통 사용하도록 했습니다.
• 초대형 정수 문자열, NA, 빈 값, 복수 값, 공백, 비문자 입력을 포함한 회귀 테스트 13개를 추가했습니다.
• 로컬 전체 testthat::test_local(): PASS
• R CMD build .: PASS
• R CMD check --no-manual --as-cran: 0 errors, 0 warnings, 기존 구조 관련 NOTE 3개만 확인했습니다(신규 제출, 기존 .semgrepignore, 기존 루트 테스트 스크립트).
• push 직전 원격 HEAD가 부모 2f71232aea979bf33d505e024763b941fe2035ea와 일치함을 확인하고 fast-forward push했습니다.

[google-labs-jules]

Current-HEAD 보강 완료: 66665fd98991228229de393c6bf3ebc74f0d3194

• 허용 입력을 단일 문자 1/2로 제한하는 내부 경계 검증을 세 대화형 프롬프트가 공통 사용하도록 했습니다.
• 초대형 정수 문자열, NA, 빈 값, 복수 값, 공백, 비문자 입력을 포함한 회귀 테스트 13개를 추가했습니다.
• 로컬 전체 testthat::test_local(): PASS
• R CMD build .: PASS
• R CMD check --no-manual --as-cran: 0 errors, 0 warnings, 기존 구조 관련 NOTE 3개만 확인했습니다(신규 제출, 기존 .semgrepignore, 기존 루트 테스트 스크립트).
• push 직전 원격 HEAD가 부모 2f71232aea979bf33d505e024763b941fe2035ea와 일치함을 확인하고 fast-forward push했습니다.

추가 보완 조치 사항과 성공적인 테스트 및 빌드 결과를 확인했습니다. 꼼꼼한 검토와 테스트 진행에 감사드립니다. 반영 내역을 확인했습니다.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Interactive prompt input validation is tightened to prevent integer overflow coercion (as.integer() returning NA) by restricting accepted responses to the explicit menu options, and the security learnings are documented.

Changes:

• Narrowed interactive prompt validation from ^[0-9]+$ to ^[12]$ in autoFIPC (3 occurrences).
• Documented the integer overflow coercion scenario and prevention guidance in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
R/aFIPC.R	Restricts interactive menu input to the exact allowed options (1/2) to avoid overflow-to-NA coercion paths.
.jules/sentinel.md	Adds a sentinel entry documenting the issue, learning, and prevention for interactive numeric input handling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[seonghobae]

Current-head correction (e37766c): the intervening 15f573e commit removed the package-level validator and all prompt-boundary regression coverage, leaving the original untested regex-only implementation. This commit restores that regression coverage on top of the latest head.

Evidence:

• focused prompt validation: 13/13 pass;
• CodeGraph resync confirms all three interactive prompt paths call .is_binary_prompt_choice;
• the resulting source tree exactly matches the previously validated 66665fd tree;
• that validated tree passed the full testthat suite, R CMD build, and R CMD check --no-manual --as-cran with 0 errors, 0 warnings, 3 pre-existing structure NOTEs.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[google-labs-jules]

Current-head correction (e37766c): the intervening 15f573e commit removed the package-level validator and all prompt-boundary regression coverage, leaving the original untested regex-only implementation. This commit restores that regression coverage on top of the latest head.

Evidence:

• focused prompt validation: 13/13 pass;
• CodeGraph resync confirms all three interactive prompt paths call .is_binary_prompt_choice;
• the resulting source tree exactly matches the previously validated 66665fd tree;
• that validated tree passed the full testthat suite, R CMD build, and R CMD check --no-manual --as-cran with 0 errors, 0 warnings, 3 pre-existing structure NOTEs.

상세한 로그 확인해 주셔서 감사합니다. 회귀 테스트와 입력값 경계 검증이 복원된 것을 파악했으며 패키지 내 정상 작동됨을 확인했습니다.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head e37766c27476549e3801875c48e9db814d0c15f0.

• Head SHA: e37766c27476549e3801875c48e9db814d0c15f0

• Workflow run: 29807530431

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test: test-prompt-validation.R"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test-prompt-validation.R"]
  R2 --> V2["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: e37766c27476549e3801875c48e9db814d0c15f0
• Workflow run: 29807530431
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head e37766c27476549e3801875c48e9db814d0c15f0.

• Head SHA: e37766c27476549e3801875c48e9db814d0c15f0

• Workflow run: 29807530431

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test: test-prompt-validation.R"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test-prompt-validation.R"]
  R2 --> V2["targeted test run"]

Loading