v4.3.3 — Security: CWE-367 TOCTOU fix (CodeQL #86 / #87)

Security patch — CWE-367 TOCTOU resolved (CodeQL #86 / #87)

Two High severity CodeQL alerts (js/file-system-race, CWE-367) introduced with the v4.3.0 CLI have been fixed. No functional changes — all 1,399 tests pass.

---

What was wrong

Both issues were classic time-of-check to time-of-use (TOCTOU) races: the file's state was read with fs.statSync(filename), and then the file was opened separately with fs.openSync(filename). In the window between those two calls, the file could be replaced or modified by another process.

---

Alert #86 — bin/cli.ts:269 (audit tail command)

Before:

const newSize = fs.statSync(logFile).size;   // ← check
if (newSize > size) {
  const fd = fs.openSync(logFile, 'r');       // ← use  (race window here)
  const buf = Buffer.alloc(newSize - size);
  fs.readSync(fd, buf, 0, buf.length, size);
  fs.closeSync(fd);
}

After — fd opened first, fstatSync on the descriptor:

const fd = fs.openSync(logFile, 'r');         // ← open first
try {
  const newSize = fs.fstatSync(fd).size;      // ← check on already-open fd
  if (newSize > size) {
    const buf = Buffer.alloc(newSize - size);
    fs.readSync(fd, buf, 0, buf.length, size);
    buf.toString('utf-8').trim().split('\n').filter(Boolean).forEach(l => console.log(l));
    size = newSize;
  }
} finally {
  fs.closeSync(fd);
}

---

Alert #87 — test-cli.ts:360 (Section 9b tail test)

Before:

const before = fs.statSync(logFile).size;
fs.appendFileSync(logFile, JSON.stringify({ event: 'write', key: 'k' }) + '\n');
const after = fs.statSync(logFile).size;

After — single fd, no filename re-check:

const fd = fs.openSync(logFile, 'a+');
try {
  const before = fs.fstatSync(fd).size;
  fs.writeSync(fd, JSON.stringify({ event: 'write', key: 'k' }) + '\n');
  const after = fs.fstatSync(fd).size;
  assert(after > before, 'file size grew after append (tail would detect this)');
} finally {
  fs.closeSync(fd);
}

---

Also in this release

• SECURITY.md Supported Versions table updated to reflect 4.3.x as current
• SECURITY.md CodeQL note updated to document both TOCTOU resolutions

---

All 1,399 assertions across 17 suites pass.
Full Changelog: https://github.com/jovanSAPFIONEER/Network-AI/blob/main/CHANGELOG.md