From d234027c5c3f41d758060bea38d758c292a8107d Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Mon, 21 Sep 2026 19:09:55 +0000
Subject: [PATCH] =?UTF-8?q?=EB=B3=B4=EC=95=88:=20=EB=8C=80=ED=99=94?=
 =?UTF-8?q?=ED=98=95=20=ED=94=84=EB=A1=AC=ED=94=84=ED=8A=B8=EC=9D=98=20?=
 =?UTF-8?q?=EC=A0=95=EC=88=98=20=EC=98=A4=EB=B2=84=ED=94=8C=EB=A1=9C?=
 =?UTF-8?q?=EC=9A=B0=20DoS=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95=20(Sentinel)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .jules/sentinel.md | 4 ++++
 R/aFIPC.R          | 6 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index a8207a48..b25258e0 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -2,3 +2,7 @@
 **Vulnerability:** Unvalidated inputs passed to `if()` statements can cause process crashes (`condition has length > 1`) or unexpected coercion vulnerabilities.
 **Learning:** In R, optional boolean parameters that default to `NULL` should be validated using explicit runtime type validation (e.g., `if (!is.null(flag) && (!is.logical(flag) || length(flag) != 1 || is.na(flag)))`).
 **Prevention:** Always implement explicit runtime type validation for optional boolean parameters.
+## 2024-10-24 - [Integer Overflow DoS in Interactive Prompts]
+**Vulnerability:** Input validation using `grepl("^[0-9]+$", n)` allows arbitrarily long numeric strings, which cause integer overflow and yield `NA` when coerced via `as.integer()`. This can lead to application crashes (Denial of Service) when evaluated in subsequent boolean logic.
+**Learning:** Regular expressions checking for digits do not account for data type limits (like maximum integer size in R). Relying on regex alone for numeric validation is insufficient when the inputs are coerced to restricted types.
+**Prevention:** Always use strict exact-match validation (e.g., `n %in% c("1", "2")`) when handling predefined option sets from user inputs to ensure robust type safety and prevent coercion errors.
diff --git a/R/aFIPC.R b/R/aFIPC.R
index 62546519..118aca09 100644
--- a/R/aFIPC.R
+++ b/R/aFIPC.R
@@ -141,7 +141,7 @@ autoFIPC <-
       }
       for (attempt in seq_len(3)) {
         n <- readline(prompt = "Is it correct? (1: Yes 2: No) : ")
-        if (grepl("^[0-9]+$", n)) {
+        if (n %in% c("1", "2")) {
           return(as.integer(n))
         }
       }
@@ -171,7 +171,7 @@ autoFIPC <-
               readline(
                 prompt = "Do you want to use default BILOG-MG priors for oldform Data? (1: Yes 2: No) : "
               )
-            if (grepl("^[0-9]+$", n)) {
+            if (n %in% c("1", "2")) {
               return(as.integer(n))
             }
           }
@@ -390,7 +390,7 @@ autoFIPC <-
               readline(
                 prompt = "Do you want to use default BILOG-MG priors for newform Data? (1: Yes 2: No) : "
               )
-            if (grepl("^[0-9]+$", n)) {
+            if (n %in% c("1", "2")) {
               return(as.integer(n))
             }
           }