From 8fa16fc81d0fa6d8c3e9ed82a713c24876946c3c Mon Sep 17 00:00:00 2001 From: Quratulain-bilal Date: Fri, 31 Jul 2026 17:49:22 +0500 Subject: [PATCH] fix: eliminate TOCTOU race in RunState.load() Remove exists() pre-check and wrap open() in try/except FileNotFoundError to provide a clear custom error message even under race conditions. --- src/specify_cli/workflows/engine.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/specify_cli/workflows/engine.py b/src/specify_cli/workflows/engine.py index fe049fd840..1f88b7f9c9 100644 --- a/src/specify_cli/workflows/engine.py +++ b/src/specify_cli/workflows/engine.py @@ -714,12 +714,12 @@ def load(cls, run_id: str, project_root: Path) -> RunState: cls._validate_run_id(run_id) runs_dir = project_root / ".specify" / "workflows" / "runs" / run_id state_path = runs_dir / "state.json" - if not state_path.exists(): + try: + with open(state_path, encoding="utf-8") as f: + state_data = json.load(f) + except FileNotFoundError: msg = f"Run state not found: {state_path}" - raise FileNotFoundError(msg) - - with open(state_path, encoding="utf-8") as f: - state_data = json.load(f) + raise FileNotFoundError(msg) from None if not isinstance(state_data, dict): raise ValueError("Invalid run state: expected a JSON object") missing_fields = [