Skip to content

wam: reject non-positive input weights instead of returning NaN - #825

Open
arpitjain099 wants to merge 1 commit into
ossf:mainfrom
arpitjain099:fix/wam-reject-non-positive-weights
Open

wam: reject non-positive input weights instead of returning NaN#825
arpitjain099 wants to merge 1 commit into
ossf:mainfrom
arpitjain099:fix/wam-reject-non-positive-weights

Conversation

@arpitjain099

Copy link
Copy Markdown

What

WeightedArithmeticMean.Score computes itemSum / itemCount, where itemCount is the running sum of the matched input weights. When that total weight is zero, the result is math.NaN(). Because Score returns a bare float64, it has no way to signal the failure, so an undefined score propagates silently to the caller.

This validates the weights up front in wam.New instead. Any input with a zero or negative weight is rejected with an error:

  • A zero weight makes the total weight zero, so the weighted mean is undefined (the divide-by-zero that produces NaN).
  • A negative weight has no meaningful interpretation in a weighted average.

This follows @calebbrown's direction on the issue: "Non-positive weights don't make much sense, and should cause an error if supplied." New already returns (algorithm.Algorithm, error), so this is the natural place to surface the problem, and Score's behavior for valid inputs is unchanged.

Why this is safe for existing configs

All shipped scorer configs (config/scorer/*.yml) use only positive weights (1, 2, 0.5), so valid configurations are unaffected. The new error only fires on a misconfigured zero or negative weight.

Tests

Extended the existing table-driven test in wam_test.go:

  • zero weight -> New returns an error (previously Score returned NaN)
  • negative weight -> New returns an error (previously Score silently returned a wrong value)
  • a single positive weight -> accepted, correct score

Before this change those first two cases produce NaN / a silently-wrong value; after, they return a clear error. go test ./internal/scorer/... passes, and gofmt/go vet are clean.

Fixes #314

WeightedArithmeticMean.Score returned itemSum/itemCount, which is NaN
when the total weight of the matched inputs is zero. Score returns a
bare float64 and cannot signal an error, so the failure was silent.

Validate inputs in wam.New: any input with a zero or negative weight is
now rejected with an error. Zero weights make the weighted mean undefined
(division by zero), and negative weights have no meaningful interpretation
in a weighted average, matching the maintainer guidance on the issue.

Existing shipped scorer configs use only positive weights, so this adds
no behavior change for valid configurations.

Fixes ossf#314

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Divide by Zero in Weighted Arithmetic Mean Algorithm

1 participant