From 6ccb875073da21380f270d780fe3091c6f400751 Mon Sep 17 00:00:00 2001 From: Quratulain-bilal Date: Fri, 31 Jul 2026 17:50:04 +0500 Subject: [PATCH] fix: eliminate TOCTOU race in yamlio.load_yaml() Remove exists() pre-check and catch FileNotFoundError from read_text() to provide a clear BundlerError even under race conditions. --- src/specify_cli/bundler/lib/yamlio.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/specify_cli/bundler/lib/yamlio.py b/src/specify_cli/bundler/lib/yamlio.py index a63d05ba4e..b7811d4909 100644 --- a/src/specify_cli/bundler/lib/yamlio.py +++ b/src/specify_cli/bundler/lib/yamlio.py @@ -54,10 +54,10 @@ def load_yaml(path: Path) -> Any: caller to reject. """ path = Path(path) - if not path.exists(): - raise BundlerError(f"File not found: {path}") try: text = path.read_text(encoding="utf-8") + except FileNotFoundError: + raise BundlerError(f"File not found: {path}") from None except (OSError, UnicodeError) as exc: # A non-UTF-8 file raises UnicodeDecodeError, which is a ValueError -- # NOT an OSError -- so it escaped this module's "IO failures degrade