From f41e4fc29079dad658c93ee4dbb14c555fbcbd1a Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Wed, 24 Jun 2026 03:54:04 +0000
Subject: [PATCH] Add input validation for security and robustness

Added input validation to `R/icci.R` for `conf.level` and to `R/vuongtest.R` for `nested` and `adj` arguments to prevent unexpected behavior.
---
 .jules/sentinel.md | 4 ++++
 R/icci.R           | 5 +++++
 R/vuongtest.R      | 8 +++++++-
 3 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..8ba40f6
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-06-24 - Input Validation Enhancement
+**Vulnerability:** Missing input validation
+**Learning:** R functions often lack input validation for arguments like `conf.level`, `nested`, and `adj`, which could lead to unexpected behavior or obscure errors downstream.
+**Prevention:** Always validate numeric ranges, logical bounds, and enum choices using `is.numeric`, `is.logical`, and `match.arg`.
diff --git a/R/icci.R b/R/icci.R
index f22278a..a17aa6c 100644
--- a/R/icci.R
+++ b/R/icci.R
@@ -65,6 +65,11 @@
 #' @export
 icci <- function(object1, object2, conf.level=.95, ll1=llcont, ll2=llcont) {
 
+  ## Input validation
+  if (!is.numeric(conf.level) || length(conf.level) != 1 || conf.level <= 0 || conf.level >= 1) {
+    stop("Argument 'conf.level' must be a single numeric value strictly between 0 and 1.")
+  }
+
   ## check objects, issue warnings/errors, get classes/calls
   obinfo <- check.obj(object1, object2)
   callA <- obinfo$callA; classA <- obinfo$classA
diff --git a/R/vuongtest.R b/R/vuongtest.R
index 57c5f6b..ecf8bde 100644
--- a/R/vuongtest.R
+++ b/R/vuongtest.R
@@ -96,7 +96,13 @@
 #' @importMethodsFrom lavaan coef fitted logLik vcov
 #' @importFrom methods slotNames
 #' @export
-vuongtest <- function(object1, object2, nested=FALSE, adj="none", ll1=llcont, ll2=llcont, score1=NULL, score2=NULL, vc1=vcov, vc2=vcov) {
+vuongtest <- function(object1, object2, nested=FALSE, adj=c("none", "aic", "bic"), ll1=llcont, ll2=llcont, score1=NULL, score2=NULL, vc1=vcov, vc2=vcov) {
+
+  ## Input validation for security and robustness
+  if (!is.logical(nested) || length(nested) != 1) {
+    stop("Argument 'nested' must be a single logical value.")
+  }
+  adj <- match.arg(adj)
 
   ## check objects, issue warnings/errors, get classes/calls
   obinfo <- check.obj(object1, object2)