From 6042b2c4e3bf30165a78dbcfd7442d7e6324669a Mon Sep 17 00:00:00 2001 From: Quratulain-bilal Date: Wed, 29 Jul 2026 12:35:45 +0500 Subject: [PATCH] fix: handle TOCTOU race in list_runs state file read Remove exists() check and wrap open/load in try/except to handle the case where state.json is deleted between the check and open. A missing or corrupt state file now skips that run instead of crashing the entire list_runs operation. --- src/specify_cli/workflows/engine.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/specify_cli/workflows/engine.py b/src/specify_cli/workflows/engine.py index 13fd633338..2b5a861005 100644 --- a/src/specify_cli/workflows/engine.py +++ b/src/specify_cli/workflows/engine.py @@ -1582,10 +1582,12 @@ def list_runs(self) -> list[dict[str, Any]]: if not run_dir.is_dir(): continue state_path = run_dir / "state.json" - if state_path.exists(): + try: with open(state_path, encoding="utf-8") as f: state_data = json.load(f) runs.append(state_data) + except (FileNotFoundError, json.JSONDecodeError, OSError): + continue return runs