From 2b5621c76003be46d8805a52bf16b421e42c8266 Mon Sep 17 00:00:00 2001 From: Quratulain-bilal Date: Wed, 29 Jul 2026 18:53:49 +0500 Subject: [PATCH] fix: eliminate TOCTOU race in zip packaging Open file once and derive both stat info and content from the same file descriptor to prevent race conditions where the file is modified between stat() and read_bytes() calls. --- src/specify_cli/bundler/services/packager.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/specify_cli/bundler/services/packager.py b/src/specify_cli/bundler/services/packager.py index 6a0778e3ab..4e14934e0a 100644 --- a/src/specify_cli/bundler/services/packager.py +++ b/src/specify_cli/bundler/services/packager.py @@ -93,9 +93,11 @@ def build_bundle( # extraction, but collapse to two canonical modes (0755 when any # execute bit is set on the source, otherwise 0644) so identical # inputs yield a byte-for-byte identical artifact. - mode = 0o755 if file_path.stat().st_mode & 0o111 else 0o644 - info.external_attr = mode << 16 - archive.writestr(info, file_path.read_bytes()) + with file_path.open("rb") as fh: + st = os.fstat(fh.fileno()) + mode = 0o755 if st.st_mode & 0o111 else 0o644 + info.external_attr = mode << 16 + archive.writestr(info, fh.read()) return BuildResult(artifact_path=artifact_path, file_count=len(files))