Skip to content

Fix size validation in sampleSizeWithSeed - #1250

Open
pavankumar-vh wants to merge 1 commit into
CodebuffAI:mainfrom
pavankumar-vh:fix/sample-size-validation
Open

Fix size validation in sampleSizeWithSeed#1250
pavankumar-vh wants to merge 1 commit into
CodebuffAI:mainfrom
pavankumar-vh:fix/sample-size-validation

Conversation

@pavankumar-vh

Copy link
Copy Markdown

Overview

Fix size validation in the sampleSizeWithSeed function in common/src/util/random.ts.

Bug Description

The function didn't validate that size is a non-negative integer. If size was NaN, negative, or not an integer, result.slice(0, size) could behave unexpectedly.

Fix

Added Number.isFinite() and size >= 0 checks to default to 0 for invalid sizes.

Testing

No existing tests for this function, but the fix prevents unexpected behavior with invalid inputs.

Files Changed

  • common/src/util/random.ts - Added size validation

Scope

This change only touches common/ which is an approved contribution area per the Contributing Guide.

The function didn't validate that size is a non-negative integer. If size was
NaN, negative, or not an integer, result.slice(0, size) could behave unexpectedly.

Added Number.isFinite() and size >= 0 checks to default to 0 for invalid sizes.
@codebuff-team

Copy link
Copy Markdown
Contributor

Good catch. Array.prototype.slice(0, size) with a negative size doesn't clamp to zero elements — it slices from the end (e.g. slice(0, -1) drops the last element instead of returning nothing), which is a real divergence from the presumed "take at most size elements" contract of sampleSizeWithSeed. Guarding with Number.isFinite(size) && size >= 0, defaulting to 0 otherwise, and flooring for non-integer input, is a reasonable and minimal fix.

A couple of things I'd want addressed before this lands:

  • No test was added. Given this is fixing a specific observed edge case (negative size), a one-line unit test asserting sampleSizeWithSeed(arr, -1, seed) returns [] would make the fix self-documenting and guard against regression.
  • Consider whether silently clamping to 0 is the right behavior vs throwing — callers passing a negative size are likely doing something wrong upstream, and silently returning [] could mask that bug. Not a blocker, just worth a sentence in the PR description about why silent-default was chosen over a thrown error.

Scope is fine (common/ is in-scope), and the diff is small and easy to review. With a small test added this is straightforward to port.

@codebuff-team codebuff-team added bot:triaged Classified by the community triage bot pr:port-candidate Worth porting into the private source tree labels Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bot:triaged Classified by the community triage bot pr:port-candidate Worth porting into the private source tree

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants