Skip to content

fix(security) : Fix race condition in file write operations (Symlink TOCTOU)#1146

Open
l3tchupkt wants to merge 3 commits intogoogle:masterfrom
l3tchupkt:fix/symlink-toctou-writefiles
Open

fix(security) : Fix race condition in file write operations (Symlink TOCTOU)#1146
l3tchupkt wants to merge 3 commits intogoogle:masterfrom
l3tchupkt:fix/symlink-toctou-writefiles

Conversation

@l3tchupkt
Copy link
Copy Markdown
Contributor

@l3tchupkt l3tchupkt commented Apr 9, 2026

fixes(#1148)
Prevent symlink race condition attacks in WriteFiles() that could allow
arbitrary file writes outside the project directory.

Changes:

  • Validate contentDir hasn't been swapped with symlink
  • Check parent directory chain for symlink attacks
  • Use O_NOFOLLOW | O_EXCL flags for atomic file writes
  • Detect and block race conditions during file creation

Fixes: TOCTOU vulnerability in pull/clone operations

  • [x ] npm run test succeeds.
  • [ x] npm run lint succeeds.
  • Appropriate changes to README are included in PR.

@l3tchupkt l3tchupkt changed the title Fix race condition in file write operations (Symlink TOCTOU) fix(security) : Fix race condition in file write operations (Symlink TOCTOU) Apr 10, 2026
@l3tchupkt
Copy link
Copy Markdown
Contributor Author

@sqrrrl please review!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant