Validate random and QR input bounds

src/core/operations/GenerateQRCode.mjs

@@ -64,6 +64,13 @@ class GenerateQRCode extends Operation {
     run(input, args) {
         const [format, size, margin, errorCorrection] = args;
 
+        if (!Number.isFinite(size) || size < 1) {
+            throw new OperationError("Module size must be greater than 0.");
+        }
+        if (!Number.isFinite(margin) || margin < 0) {
+            throw new OperationError("Margin must be greater than or equal to 0.");
+        }
+
         return generateQrCode(input, format, size, margin, errorCorrection);
     }
 

src/core/operations/PseudoRandomIntegerGenerator.mjs

@@ -80,6 +80,10 @@ class PseudoRandomIntegerGenerator extends Operation {
 
         if (minInt === null || maxInt === null) return "";
 
+        if (!Number.isSafeInteger(numInts) || numInts < 1) {
+            throw new OperationError("Number of Integers must be a positive integer.");
+        }
+
         const min = Math.ceil(minInt);
         const max = Math.floor(maxInt);
         const delim = Utils.charRep(delimiter || "Space");

src/core/operations/PseudoRandomNumberGenerator.mjs

@@ -5,6 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
 import Utils from "../Utils.mjs";
 import forge from "node-forge";
 import BigNumber from "bignumber.js";
@@ -49,6 +50,10 @@ class PseudoRandomNumberGenerator extends Operation {
     run(input, args) {
         const [numBytes, outputAs] = args;
 
+        if (!Number.isSafeInteger(numBytes) || numBytes < 0) {
+            throw new OperationError("Number of bytes must be a non-negative integer.");
+        }
+
         let bytes;
 
         if (isWorkerEnvironment() && self.crypto) {

tests/operations/index.mjs

@@ -142,6 +142,7 @@ import "./tests/ParityBit.mjs";
 import "./tests/PHPSerialize.mjs";
 import "./tests/PowerSet.mjs";
 import "./tests/Protobuf.mjs";
+import "./tests/PseudoRandom.mjs";
 import "./tests/PubKeyFromCert.mjs";
 import "./tests/PubKeyFromPrivKey.mjs";
 import "./tests/Rabbit.mjs";

tests/operations/tests/GenerateQRCode.mjs

@@ -64,4 +64,26 @@ TestRegister.addTests([
             },
         ],
     },
+    {
+        name: "Generate QR Code: negative module size",
+        input: "a",
+        expectedOutput: "Module size must be greater than 0.",
+        recipeConfig: [
+            {
+                "op": "Generate QR Code",
+                "args": ["PNG", -5, 4, "Medium"]
+            },
+        ],
+    },
+    {
+        name: "Generate QR Code: negative margin",
+        input: "a",
+        expectedOutput: "Margin must be greater than or equal to 0.",
+        recipeConfig: [
+            {
+                "op": "Generate QR Code",
+                "args": ["PNG", 5, -4, "Medium"]
+            },
+        ],
+    },
 ]);

tests/operations/tests/PseudoRandom.mjs

@@ -0,0 +1,33 @@
+/**
+ * Pseudo-Random operation tests.
+ *
+ * @author paulolokaux-sudo
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "Pseudo-Random Number Generator: negative byte count",
+        input: "",
+        expectedOutput: "Number of bytes must be a non-negative integer.",
+        recipeConfig: [
+            {
+                op: "Pseudo-Random Number Generator",
+                args: [-32, "Hex"]
+            }
+        ]
+    },
+    {
+        name: "Pseudo-Random Integer Generator: negative integer count",
+        input: "",
+        expectedOutput: "Number of Integers must be a positive integer.",
+        recipeConfig: [
+            {
+                op: "Pseudo-Random Integer Generator",
+                args: [-1, -10, -9, "Space", "Raw"]
+            }
+        ]
+    }
+]);