Skip to content

Commit c807e24

Browse files
fix: remove TOCTOU race in RunState.load (#3839)
Remove exists() check before open() and catch FileNotFoundError directly. This prevents a race where the file is deleted between check and open, while preserving the descriptive error message.
1 parent 56aec8a commit c807e24

1 file changed

Lines changed: 5 additions & 4 deletions

File tree

src/specify_cli/workflows/engine.py

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -743,12 +743,13 @@ def load(cls, run_id: str, project_root: Path) -> RunState:
743743
cls._validate_run_id(run_id)
744744
runs_dir = project_root / ".specify" / "workflows" / "runs" / run_id
745745
state_path = runs_dir / "state.json"
746-
if not state_path.exists():
746+
747+
try:
748+
with open(state_path, encoding="utf-8") as f:
749+
state_data = json.load(f)
750+
except FileNotFoundError:
747751
msg = f"Run state not found: {state_path}"
748752
raise FileNotFoundError(msg)
749-
750-
with open(state_path, encoding="utf-8") as f:
751-
state_data = json.load(f)
752753
if not isinstance(state_data, dict):
753754
raise ValueError("Invalid run state: expected a JSON object")
754755
missing_fields = [

0 commit comments

Comments
 (0)