#465 Race Condition: TOCTOU in http_request.py and shell_command.py cache check

closed high Created 2025-12-17 01:11 · Updated 2025-12-17 01:15

Description

Edit
Two files have Time-Of-Check-Time-Of-Use (TOCTOU) race conditions in _should_clear_cache(): 1. engine/tools/http_request.py:224-231 2. engine/tools/shell_command.py:119-127 Pattern: ```python if not os.path.exists(flag_file): # CHECK return False mtime = os.path.getmtime(flag_file) # ACT - file may be deleted between check and use ``` Another thread/process can delete the file between exists() and getmtime(), causing FileNotFoundError. FIX: Use try/except around file operations instead of check-then-act pattern.

Comments

Loading comments...

Context

Loading context...

Audit History

View All
Loading audit history...