Security review (lite)

Findings

1. Missing input validation / type confusion

   • Severity: Low
   • Line ref: 1
   • Exploit sketch: Calling add("1", "2") returns "12" because + performs string concatenation when either operand is a string.
   • Fix: Declare numeric parameter and return types, validate values at runtime, and reject non-finite numbers.

2. Injection

   • Severity: None identified
   • Line ref: N/A
   • Exploit sketch: The function does not pass input to an interpreter, database, shell, HTML sink, or other injection-sensitive context.
   • Fix: None required; avoid using the result in sensitive sinks without context-appropriate encoding or parameterization.

3. Broken authorization

   • Severity: None identified
   • Line ref: N/A
   • Exploit sketch: This arithmetic helper does not access protected resources or perform privileged actions.
   • Fix: Enforce authorization at the boundary of any protected operation that uses this function.

4. Secrets in code

   • Severity: None identified
   • Line ref: N/A
   • Exploit sketch: No credentials, tokens, keys, or other secrets are present.
   • Fix: Keep secrets outside source code, such as in a managed secret store.

5. Unsafe deserialization

   • Severity: None identified
   • Line ref: N/A
   • Exploit sketch: The function performs no parsing or deserialization.
   • Fix: If values later come from serialized input, parse with a trusted parser and validate their schema before calling this function.

Hardened code

export function add(a: number, b: number): number {
  if (!Number.isFinite(a) || !Number.isFinite(b)) {
    throw new TypeError("a and b must be finite numbers");
  }

  const result = a + b;

  if (!Number.isFinite(result)) {
    throw new RangeError("result is outside the finite number range");
  }

  return result;
}