From 067fcab83e49594411a366b1c7b935c6c5e41db3 Mon Sep 17 00:00:00 2001
From: paulolokaux-sudo <286603047+paulolokaux-sudo@users.noreply.github.com>
Date: Sun, 31 May 2026 05:04:35 +0200
Subject: [PATCH] Validate random and QR input bounds

---
 src/core/operations/GenerateQRCode.mjs        |  7 ++++
 .../PseudoRandomIntegerGenerator.mjs          |  4 +++
 .../PseudoRandomNumberGenerator.mjs           |  5 +++
 tests/operations/index.mjs                    |  1 +
 tests/operations/tests/GenerateQRCode.mjs     | 22 +++++++++++++
 tests/operations/tests/PseudoRandom.mjs       | 33 +++++++++++++++++++
 6 files changed, 72 insertions(+)
 create mode 100644 tests/operations/tests/PseudoRandom.mjs

diff --git a/src/core/operations/GenerateQRCode.mjs b/src/core/operations/GenerateQRCode.mjs
index d3e1ee3b..af85f49e 100644
--- a/src/core/operations/GenerateQRCode.mjs
+++ b/src/core/operations/GenerateQRCode.mjs
@@ -64,6 +64,13 @@ class GenerateQRCode extends Operation {
     run(input, args) {
         const [format, size, margin, errorCorrection] = args;
 
+        if (!Number.isFinite(size) || size < 1) {
+            throw new OperationError("Module size must be greater than 0.");
+        }
+        if (!Number.isFinite(margin) || margin < 0) {
+            throw new OperationError("Margin must be greater than or equal to 0.");
+        }
+
         return generateQrCode(input, format, size, margin, errorCorrection);
     }
 
diff --git a/src/core/operations/PseudoRandomIntegerGenerator.mjs b/src/core/operations/PseudoRandomIntegerGenerator.mjs
index a2d83a92..ce2b57e4 100644
--- a/src/core/operations/PseudoRandomIntegerGenerator.mjs
+++ b/src/core/operations/PseudoRandomIntegerGenerator.mjs
@@ -80,6 +80,10 @@ class PseudoRandomIntegerGenerator extends Operation {
 
         if (minInt === null || maxInt === null) return "";
 
+        if (!Number.isSafeInteger(numInts) || numInts < 1) {
+            throw new OperationError("Number of Integers must be a positive integer.");
+        }
+
         const min = Math.ceil(minInt);
         const max = Math.floor(maxInt);
         const delim = Utils.charRep(delimiter || "Space");
diff --git a/src/core/operations/PseudoRandomNumberGenerator.mjs b/src/core/operations/PseudoRandomNumberGenerator.mjs
index 53150566..d571af5d 100644
--- a/src/core/operations/PseudoRandomNumberGenerator.mjs
+++ b/src/core/operations/PseudoRandomNumberGenerator.mjs
@@ -5,6 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
 import Utils from "../Utils.mjs";
 import forge from "node-forge";
 import BigNumber from "bignumber.js";
@@ -49,6 +50,10 @@ class PseudoRandomNumberGenerator extends Operation {
     run(input, args) {
         const [numBytes, outputAs] = args;
 
+        if (!Number.isSafeInteger(numBytes) || numBytes < 0) {
+            throw new OperationError("Number of bytes must be a non-negative integer.");
+        }
+
         let bytes;
 
         if (isWorkerEnvironment() && self.crypto) {
diff --git a/tests/operations/index.mjs b/tests/operations/index.mjs
index c12c2710..402802bf 100644
--- a/tests/operations/index.mjs
+++ b/tests/operations/index.mjs
@@ -142,6 +142,7 @@ import "./tests/ParityBit.mjs";
 import "./tests/PHPSerialize.mjs";
 import "./tests/PowerSet.mjs";
 import "./tests/Protobuf.mjs";
+import "./tests/PseudoRandom.mjs";
 import "./tests/PubKeyFromCert.mjs";
 import "./tests/PubKeyFromPrivKey.mjs";
 import "./tests/Rabbit.mjs";
diff --git a/tests/operations/tests/GenerateQRCode.mjs b/tests/operations/tests/GenerateQRCode.mjs
index 99ed8f9d..68d64ab6 100644
--- a/tests/operations/tests/GenerateQRCode.mjs
+++ b/tests/operations/tests/GenerateQRCode.mjs
@@ -64,4 +64,26 @@ TestRegister.addTests([
             },
         ],
     },
+    {
+        name: "Generate QR Code: negative module size",
+        input: "a",
+        expectedOutput: "Module size must be greater than 0.",
+        recipeConfig: [
+            {
+                "op": "Generate QR Code",
+                "args": ["PNG", -5, 4, "Medium"]
+            },
+        ],
+    },
+    {
+        name: "Generate QR Code: negative margin",
+        input: "a",
+        expectedOutput: "Margin must be greater than or equal to 0.",
+        recipeConfig: [
+            {
+                "op": "Generate QR Code",
+                "args": ["PNG", 5, -4, "Medium"]
+            },
+        ],
+    },
 ]);
diff --git a/tests/operations/tests/PseudoRandom.mjs b/tests/operations/tests/PseudoRandom.mjs
new file mode 100644
index 00000000..40bdd89b
--- /dev/null
+++ b/tests/operations/tests/PseudoRandom.mjs
@@ -0,0 +1,33 @@
+/**
+ * Pseudo-Random operation tests.
+ *
+ * @author paulolokaux-sudo
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "Pseudo-Random Number Generator: negative byte count",
+        input: "",
+        expectedOutput: "Number of bytes must be a non-negative integer.",
+        recipeConfig: [
+            {
+                op: "Pseudo-Random Number Generator",
+                args: [-32, "Hex"]
+            }
+        ]
+    },
+    {
+        name: "Pseudo-Random Integer Generator: negative integer count",
+        input: "",
+        expectedOutput: "Number of Integers must be a positive integer.",
+        recipeConfig: [
+            {
+                op: "Pseudo-Random Integer Generator",
+                args: [-1, -10, -9, "Space", "Raw"]
+            }
+        ]
+    }
+]);