From 2070c0c63a370b324d076efab860a16ba17d7384 Mon Sep 17 00:00:00 2001
From: kassoulet <1905+kassoulet@users.noreply.github.com>
Date: Mon, 4 May 2026 13:27:09 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Fix=20NaN=20validation=20and=20empty=20chain=20panic?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add is_finite() check for plugin parameters in YAML mapping format.
- Centralize empty plugin chain check to prevent panics when loading empty YAML configs.
- Update Sentinel journal.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
---
 .jules/sentinel.md | 5 +++++
 src/config.rs      | 3 +++
 src/main.rs        | 7 ++++---
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 0a44952..18d09f4 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -2,3 +2,8 @@
 **Vulnerability:** Missing input validation for plugin parameters (allowing NaN/Infinity) and lack of resource limits (unbounded block size and drain time).
 **Learning:** CLI applications that process external data or use plugin systems must strictly validate all user-provided inputs, including numeric parameters, to prevent unexpected behavior or resource exhaustion.
 **Prevention:** Implement strict range checks and sanity checks for all CLI arguments and configuration file inputs.
+
+## 2025-01-24 - [Partial Validation and Empty Chain DoS]
+**Vulnerability:** Input validation for plugin parameters was missing for YAML mapping formats, and an empty plugin chain (possible via YAML) caused an index-out-of-bounds panic.
+**Learning:** Security checks must be applied at all entry points (CLI and Config) and after all loading logic is complete, rather than just in one branch of the initialization.
+**Prevention:** Centralize core validation logic so it applies regardless of the input source.
diff --git a/src/config.rs b/src/config.rs
index 5aeaa40..1f59540 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -108,6 +108,9 @@ pub fn load_chain_from_yaml(config_path: &Path) -> Result<Vec<PluginSetting>> {
                     for (pk, pv) in param_map {
                         let p_name = pk.as_str().ok_or_else(|| anyhow!("Param name must be a string"))?;
                         let p_val = pv.as_f64().ok_or_else(|| anyhow!("Param value for '{}' must be a number", p_name))? as f32;
+                        if !p_val.is_finite() {
+                            bail!("Parameter '{}' must be a finite number", p_name);
+                        }
                         params.insert(p_name.to_string(), p_val);
                     }
                 }
diff --git a/src/main.rs b/src/main.rs
index 155f8f1..815670d 100755
--- a/src/main.rs
+++ b/src/main.rs
@@ -56,12 +56,13 @@ fn main() -> Result<()> {
     let plugins = if let Some(config_path) = &args.file {
         load_chain_from_yaml(config_path)?
     } else {
-        if args.plugins.is_empty() {
-            bail!("At least one plugin must be specified via CLI or config file (-f)");
-        }
         args.plugins
     };
 
+    if plugins.is_empty() {
+        bail!("At least one plugin must be specified via CLI or config file (-f)");
+    }
+
     println!("Probing input file: {:?}", args.input);
     let mut audio_input = setup_input_audio(&args.input)?;