From a7f7ee7cb91801d52fcc60d25f96753ef8df3ce8 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Tue, 30 Jun 2026 15:49:42 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?= =?UTF-8?q?Fix=20missing=20input=20validation=20(division=20by=20zero=20ri?= =?UTF-8?q?sk)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: CFMVCarlos <63164188+CFMVCarlos@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ lib/voltage_divider_calculations.py | 13 +++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..22f09e0 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2024-06-30 - Missing Input Validation Exposing Stack Traces +**Vulnerability:** The `voltage_divider_calculations` function lacked input validation for edge cases like zero resistance or equal input/output voltages, leading to unhandled `ZeroDivisionError` exceptions. Unhandled exceptions can expose internal application details through stack traces, a common security risk (Information Exposure). +**Learning:** Mathematical operations involving user-provided inputs must explicitly check for boundary conditions (like division by zero) and physically impossible states (like negative resistance) to prevent unhandled exceptions and potential denial of service or information leakage. +**Prevention:** Always validate inputs before using them in calculations. Ensure that user-facing functions fail gracefully with safe, informative error messages (like `ValueError`) rather than propagating system-level exceptions. diff --git a/lib/voltage_divider_calculations.py b/lib/voltage_divider_calculations.py index 91f3430..32d4ad5 100644 --- a/lib/voltage_divider_calculations.py +++ b/lib/voltage_divider_calculations.py @@ -26,6 +26,11 @@ def voltage_divider_calculations( ValueError: If there is insufficient data to perform the calculation or too many arguments are provided. """ + # Input validation + for name, value in [("Vin", vin), ("Vout", vout), ("R1", r1), ("R2", r2)]: + if value is not None and value < 0: + raise ValueError(f"{name} cannot be negative.") + # If Vin is not provided, calculate Vin based on the other values if vin is None: # Ensure vout, r1, and r2 are provided to calculate Vin @@ -33,6 +38,8 @@ def voltage_divider_calculations( raise ValueError( "Insufficient data to calculate Vin. Provide Vout, R1, and R2." ) + if r2 == 0: + raise ValueError("R2 cannot be zero when calculating Vin.") # Calculate Vin using the rearranged voltage divider formula: Vin = Vout * (R1 + R2) / R2 return vout * (r1 + r2) / r2 @@ -43,6 +50,8 @@ def voltage_divider_calculations( raise ValueError( "Insufficient data to calculate Vout. Provide Vin, R1, and R2." ) + if r1 + r2 == 0: + raise ValueError("The sum of R1 and R2 cannot be zero.") # Calculate Vout using the voltage divider formula: Vout = Vin * (R2 / (R1 + R2)) return vin * (r2 / (r1 + r2)) @@ -53,6 +62,8 @@ def voltage_divider_calculations( raise ValueError( "Insufficient data to calculate R1. Provide Vout, Vin, and R2." ) + if vin == vout: + raise ValueError("Vin and Vout cannot be equal when calculating R1.") # Calculate R1 using the rearranged formula: R1 = (Vout * R2) / (Vin - Vout) return vout * r2 / (vin - vout) @@ -63,6 +74,8 @@ def voltage_divider_calculations( raise ValueError( "Insufficient data to calculate R2. Provide Vout, Vin, and R1." ) + if vin == vout: + raise ValueError("Vin and Vout cannot be equal when calculating R2.") # Calculate R2 using the rearranged formula: R2 = (Vout * R1) / (Vin - Vout) return vout * r1 / (vin - vout)