From 393dfce60b1783d9429bab16a790a09099c06f8d Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 28 Jul 2026 19:06:56 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITIC?=
 =?UTF-8?q?AL]=20Fix=20integer=20overflow=20coercion=20vulnerability=20in?=
 =?UTF-8?q?=20readline=20input=20validation?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .jules/sentinel.md | 5 +++++
 R/aFIPC.R          | 6 +++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index a8207a4..bcbca03 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -2,3 +2,8 @@
 **Vulnerability:** Unvalidated inputs passed to `if()` statements can cause process crashes (`condition has length > 1`) or unexpected coercion vulnerabilities.
 **Learning:** In R, optional boolean parameters that default to `NULL` should be validated using explicit runtime type validation (e.g., `if (!is.null(flag) && (!is.logical(flag) || length(flag) != 1 || is.na(flag)))`).
 **Prevention:** Always implement explicit runtime type validation for optional boolean parameters.
+
+## 2024-07-28 - Fix integer overflow coercion in readline input validation
+**Vulnerability:** Unbounded digit class regex (e.g., `^[0-9]+$`) used for validating user input expecting a single-digit integer choice allows extremely large numeric strings to pass the regex check, which subsequently evaluate to `NA` in `as.integer(n)`. This causes a process crash due to `missing value where TRUE/FALSE needed`.
+**Learning:** When validating interactive `readline()` numeric inputs in R, unbounded regex checks allow integer overflow coercion vulnerabilities.
+**Prevention:** Strictly match against exact expected values (e.g., `^[12]$`) instead of using unbounded digit classes to ensure the input evaluates safely and correctly.
diff --git a/R/aFIPC.R b/R/aFIPC.R
index 6254651..918e19b 100644
--- a/R/aFIPC.R
+++ b/R/aFIPC.R
@@ -141,7 +141,7 @@ autoFIPC <-
       }
       for (attempt in seq_len(3)) {
         n <- readline(prompt = "Is it correct? (1: Yes 2: No) : ")
-        if (grepl("^[0-9]+$", n)) {
+        if (grepl("^[12]$", n)) {
           return(as.integer(n))
         }
       }
@@ -171,7 +171,7 @@ autoFIPC <-
               readline(
                 prompt = "Do you want to use default BILOG-MG priors for oldform Data? (1: Yes 2: No) : "
               )
-            if (grepl("^[0-9]+$", n)) {
+            if (grepl("^[12]$", n)) {
               return(as.integer(n))
             }
           }
@@ -390,7 +390,7 @@ autoFIPC <-
               readline(
                 prompt = "Do you want to use default BILOG-MG priors for newform Data? (1: Yes 2: No) : "
               )
-            if (grepl("^[0-9]+$", n)) {
+            if (grepl("^[12]$", n)) {
               return(as.integer(n))
             }
           }

From 5c228443b4bc427d020e0662a1750ad2f83b8be0 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 28 Jul 2026 19:45:42 +0000
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITIC?=
 =?UTF-8?q?AL]=20Fix=20integer=20overflow=20coercion=20vulnerability=20in?=
 =?UTF-8?q?=20readline=20input=20validation=20and=20clean=20up=20artifacts?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .Rbuildignore     | 1 +
 test_dummy.R      | 2 --
 test_validation.R | 3 ---
 3 files changed, 1 insertion(+), 5 deletions(-)
 delete mode 100644 test_dummy.R
 delete mode 100644 test_validation.R

diff --git a/.Rbuildignore b/.Rbuildignore
index 232504f..440d28e 100644
--- a/.Rbuildignore
+++ b/.Rbuildignore
@@ -22,3 +22,4 @@
 ^\.jules(/.*)?$
 ^\.trivyignore\.yaml$
 ^trivy\.yaml$
+.semgrepignore
diff --git a/test_dummy.R b/test_dummy.R
deleted file mode 100644
index e6f7019..0000000
--- a/test_dummy.R
+++ /dev/null
@@ -1,2 +0,0 @@
-source("R/aFIPC.R")
-source("R/surveyFA.R")
diff --git a/test_validation.R b/test_validation.R
deleted file mode 100644
index f084116..0000000
--- a/test_validation.R
+++ /dev/null
@@ -1,3 +0,0 @@
-source("R/aFIPC.R")
-source("R/surveyFA.R")
-print("Syntax check passed")