🛡️ Sentinel: [MEDIUM] Fix information disclosure in error handling - #37
🛡️ Sentinel: [MEDIUM] Fix information disclosure in error handling#37seonghobae wants to merge 5 commits into
Conversation
Added `silent = TRUE` to a `try()` block in `R/llcont.R` to prevent internal execution errors from leaking to standard error.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Adds tests/testthat/test_vuongtest.R and tests/testthat/test_icci.R exercising the Vuong (1989) test-statistic machinery (vuongtest, calcAB, calcLambda, calcBcross, check.obj, print.vuongtest) and the AIC/BIC confidence-interval machinery (icci, print.icci) using base-R glm/lm and lavaan model objects only. This code path was previously reachable only through the mirt-guarded DiscreteClass test, which is skipped whenever the heavy mirt Suggests is unavailable (e.g. in the coverage runner), leaving the core statistical engine uncovered. Expected values are recomputed independently from the documented formulas, so the statistical contract is verified rather than echoed. No source / formula changes. Light-dependency line coverage: icci.R 53.8%->100%, vuongtest.R 45.6%->81.9%. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RTAMs4bpSZS77Xe3RQjv9P
Added `silent = TRUE` to a `try()` block in `R/llcont.R` to prevent internal execution errors from leaking to standard error.
Added `silent = TRUE` to a `try()` block in `R/llcont.R` to prevent internal execution errors from leaking to standard error.
Added `silent = TRUE` to a `try()` block in `R/llcont.R` to prevent internal execution errors from leaking to standard error.
|
Closing as a strict subset of #39: this PR guards only the second Generated by Claude Code |
Understood. Acknowledging that this work is now obsolete as it is superseded by the more comprehensive fix in #39, and stopping work on this task. |
1 participant
🛡️ Sentinel: [MEDIUM] Fix information disclosure in error handling
Severity: MEDIUM
Vulnerability: Information leakage through default error handling in R
try()statements.Impact:
try()defaults to printing error messages to the standard error output unlesssilent = TRUEis specified. In the context of mathematical libraries (like evaluating multivariate normals with potentially singular matrices), this can leak internal execution errors, paths, or variables to system logs, providing an attacker with unnecessary details about the system's internal state.Fix: Modified the
try()block inR/llcont.Rto explicitly includesilent = TRUE, ensuring exceptions are caught and handled gracefully as intended without printing to standard error. Added an explanatory security comment.Verification: The code diff confirms the addition of the
silent = TRUEflag and explanatory comment. Local logic remains intact (the next line correctly handles"try-error"class).PR created automatically by Jules for task 12740505100845383346 started by @seonghobae