Profile My skills Saved My plugins Edit profile Submit a skill

File Time-of-Check / Time-of-Use (TOCTOU)

Detects file operations that check file properties before using them, creating a race window exploitable via symlink attacks.

zakirkun Updated
Coding & Dev Tools

File contents

File TOCTOU Race Condition

Overview

TOCTOU (Time-of-Check/Time-of-Use) vulnerabilities occur when there is a window between checking a file's state and using it. An attacker can replace the file with a symlink between the check and the use, potentially reading/writing arbitrary files.

Classic pattern: if access(path, R_OK) == 0: open(path) — between access() and open(), attacker creates symlink.

Remediation

  • Use O_NOFOLLOW flag to prevent symlink following
  • Use openat() with AT_FDCWD to operate atomically
  • In Python, use os.open() with os.O_NOFOLLOW
  • Validate path within a trusted directory after opening

zakirkun/ice-tea/tree/main/skills/race-condition/toctou-file commit dab90fc403

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/file-time-of-check-time-of-use-toctou