gh-143010: Prevent a TOCTOU issue by only calling open once #143011
Conversation
AZero13
changed the title
… TOCTOU issue by only calling open once We can literally just use open(path, 'xb+') for _create_carefully.
sobolevn
left a comment
sobolevn
left a comment
There was a problem hiding this comment.
Can you please start with a failing test that can show us what's wrong?
This is going to be very difficult given the fact it has to be precisely timed to the nanosecond as it is between opening of the file descriptor to the opening of the path again. |
|
By the way, this code is older than the "x" was added in 2012, which is why this wasn't used in the first place. |
|
I think that you can create a test by mocking open with a side_effect that munges things before making the real open call. Is that worth doing? |
Misc/NEWS.d/next/Library/2025-12-20-01-49-02.gh-issue-143010._-SWX0.rst
Outdated
Show resolved
Hide resolved
|
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated. Once you have made the requested changes, please leave a comment on this pull request containing the phrase |
Misc/NEWS.d/next/Library/2025-12-20-01-49-02.gh-issue-143010._-SWX0.rst
Outdated
Show resolved
Hide resolved
Co-authored-by: sobolevn <mail@sobolevn.me>
3 participants
We can literally just use open(path, 'xb+') for _create_carefully
mailbox._create_carefullyhas a possible toctou error #143010