🛡️ Sentinel: [MEDIUM] Add input validation to Duck<T> extension#49
🛡️ Sentinel: [MEDIUM] Add input validation to Duck<T> extension#49timonkrebs wants to merge 1 commit into
Conversation
Co-authored-by: timonkrebs <11026852+timonkrebs@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
There was a problem hiding this comment.
Pull request overview
This PR hardens the Duck<T> runtime fallback in NTypeForge by adding an explicit null check for the extension-method receiver, ensuring null inputs fail fast with a clear exception instead of falling through to a misleading InvalidOperationException.
Changes:
- Added
ArgumentNullException.ThrowIfNull(instance);at the start ofDuck<T>to validate theinstanceparameter.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| public static T Duck<T>(this object instance) where T : class | ||
| { | ||
| ArgumentNullException.ThrowIfNull(instance); | ||
|
|
🚨 Severity: MEDIUM
💡 Vulnerability: The
Duck<T>extension method lacked input validation for theinstanceparameter. If a null instance was passed, the code fell through to a confusingInvalidOperationExceptionclaiming no proxy was generated, instead of failing fast with a proper exception.🎯 Impact: This could lead to confusing stack traces and masked null reference issues downstream, violating the principle of failing securely and predictably.
🔧 Fix: Added
ArgumentNullException.ThrowIfNull(instance);at the beginning of theDuck<T>method to explicitly validate the input.✅ Verification: Ran
dotnet testsuccessfully, ensuring the method's behavior is correct without breaking existing tests.PR created automatically by Jules for task 216805755355021586 started by @timonkrebs