From 9c1819dea9c027b9c569fdbaad71072aba7cb42d Mon Sep 17 00:00:00 2001 From: Quratulain-bilal Date: Fri, 31 Jul 2026 17:51:23 +0500 Subject: [PATCH] fix: eliminate TOCTOU races in catalog_fetch() for file:// and bare path URLs Remove exists() pre-checks and catch FileNotFoundError from read_text() to provide clear BundlerError messages even under race conditions. --- src/specify_cli/bundler/services/adapters.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/specify_cli/bundler/services/adapters.py b/src/specify_cli/bundler/services/adapters.py index f6a1d466ba..ba961a1d02 100644 --- a/src/specify_cli/bundler/services/adapters.py +++ b/src/specify_cli/bundler/services/adapters.py @@ -143,15 +143,17 @@ def fetch(source: CatalogSource) -> dict: if scheme == "file": path = _file_url_to_path(parsed) - if not path.exists(): - raise BundlerError(f"Catalog file not found: {path}") - return loads_json(path.read_text(encoding="utf-8"), origin=str(path)) + try: + return loads_json(path.read_text(encoding="utf-8"), origin=str(path)) + except FileNotFoundError: + raise BundlerError(f"Catalog file not found: {path}") from None if scheme == "" or _is_windows_drive_path(url): path = Path(url) - if not path.exists(): - raise BundlerError(f"Catalog file not found: {path}") - return loads_json(path.read_text(encoding="utf-8"), origin=str(path)) + try: + return loads_json(path.read_text(encoding="utf-8"), origin=str(path)) + except FileNotFoundError: + raise BundlerError(f"Catalog file not found: {path}") from None if scheme in ("http", "https"): if not allow_network: