Skip to content

🛡️ Sentinel: [MEDIUM] Add input validation to Duck<T> extension#49

Closed
timonkrebs wants to merge 1 commit into
mainfrom
sentinel-null-check-216805755355021586
Closed

🛡️ Sentinel: [MEDIUM] Add input validation to Duck<T> extension#49
timonkrebs wants to merge 1 commit into
mainfrom
sentinel-null-check-216805755355021586

Conversation

@timonkrebs

Copy link
Copy Markdown
Owner

🚨 Severity: MEDIUM
💡 Vulnerability: The Duck<T> extension method lacked input validation for the instance parameter. If a null instance was passed, the code fell through to a confusing InvalidOperationException claiming no proxy was generated, instead of failing fast with a proper exception.
🎯 Impact: This could lead to confusing stack traces and masked null reference issues downstream, violating the principle of failing securely and predictably.
🔧 Fix: Added ArgumentNullException.ThrowIfNull(instance); at the beginning of the Duck<T> method to explicitly validate the input.
✅ Verification: Ran dotnet test successfully, ensuring the method's behavior is correct without breaking existing tests.


PR created automatically by Jules for task 216805755355021586 started by @timonkrebs

Co-authored-by: timonkrebs <11026852+timonkrebs@users.noreply.github.com>
Copilot AI review requested due to automatic review settings July 6, 2026 10:01
@google-labs-jules

Copy link
Copy Markdown
Contributor

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the Duck<T> runtime fallback in NTypeForge by adding an explicit null check for the extension-method receiver, ensuring null inputs fail fast with a clear exception instead of falling through to a misleading InvalidOperationException.

Changes:

  • Added ArgumentNullException.ThrowIfNull(instance); at the start of Duck<T> to validate the instance parameter.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 66 to +69
public static T Duck<T>(this object instance) where T : class
{
ArgumentNullException.ThrowIfNull(instance);

@timonkrebs timonkrebs closed this Jul 20, 2026
@timonkrebs
timonkrebs deleted the sentinel-null-check-216805755355021586 branch July 20, 2026 20:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants