🛡️ Sentinel: [MEDIUM] Fix NaN validation and empty chain panic

.jules/sentinel.md

@@ -2,3 +2,8 @@
 **Vulnerability:** Missing input validation for plugin parameters (allowing NaN/Infinity) and lack of resource limits (unbounded block size and drain time).
 **Learning:** CLI applications that process external data or use plugin systems must strictly validate all user-provided inputs, including numeric parameters, to prevent unexpected behavior or resource exhaustion.
 **Prevention:** Implement strict range checks and sanity checks for all CLI arguments and configuration file inputs.
+
+## 2025-01-24 - [Partial Validation and Empty Chain DoS]
+**Vulnerability:** Input validation for plugin parameters was missing for YAML mapping formats, and an empty plugin chain (possible via YAML) caused an index-out-of-bounds panic.
+**Learning:** Security checks must be applied at all entry points (CLI and Config) and after all loading logic is complete, rather than just in one branch of the initialization.
+**Prevention:** Centralize core validation logic so it applies regardless of the input source.

src/config.rs

@@ -108,6 +108,9 @@ pub fn load_chain_from_yaml(config_path: &Path) -> Result<Vec<PluginSetting>> {
                     for (pk, pv) in param_map {
                         let p_name = pk.as_str().ok_or_else(|| anyhow!("Param name must be a string"))?;
                         let p_val = pv.as_f64().ok_or_else(|| anyhow!("Param value for '{}' must be a number", p_name))? as f32;
+                        if !p_val.is_finite() {
+                            bail!("Parameter '{}' must be a finite number", p_name);
+                        }
                         params.insert(p_name.to_string(), p_val);
                     }
                 }

src/main.rs

@@ -56,12 +56,13 @@ fn main() -> Result<()> {
     let plugins = if let Some(config_path) = &args.file {
         load_chain_from_yaml(config_path)?
     } else {
-        if args.plugins.is_empty() {
-            bail!("At least one plugin must be specified via CLI or config file (-f)");
-        }
         args.plugins
     };
 
+    if plugins.is_empty() {
+        bail!("At least one plugin must be specified via CLI or config file (-f)");
+    }
+
     println!("Probing input file: {:?}", args.input);
     let mut audio_input = setup_input_audio(&args.input)?;