Skip to content

Avoid getattrlist TOCTOU issue for atomic file writing #1805

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmschonfeld merged 1 commit into from
Mar 10, 2026
Merged

Avoid getattrlist TOCTOU issue for atomic file writing #1805

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 11 additions & 12 deletions Sources/FoundationEssentials/Data/Data+Writing.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -476,22 +476,21 @@ private func writeToFileAux(path inPath: borrowing some FileSystemRepresentable
var newPath = inPath.path
var preRenameAttributes = PreRenameAttributes()
var attrs = attrlist(bitmapcount: u_short(ATTR_BIT_MAP_COUNT), reserved: 0, commonattr: attrgroup_t(ATTR_CMN_OBJTYPE | ATTR_CMN_ACCESSMASK | ATTR_CMN_FULLPATH), volattr: .init(), dirattr: .init(), fileattr: .init(ATTR_FILE_LINKCOUNT), forkattr: .init())
let result = getattrlist(inPathFileSystemRep, &attrs, &preRenameAttributes, MemoryLayout<PreRenameAttributes>.size, .init(FSOPT_NOFOLLOW))
// Provide FSOPT_UNIQUE to ensure that the file is a regular file with a single hard link (so that we can rely on ATTR_CMN_FULLPATH)
let result = getattrlist(inPathFileSystemRep, &attrs, &preRenameAttributes, MemoryLayout<PreRenameAttributes>.size, .init(FSOPT_NOFOLLOW | FSOPT_UNIQUE))
if result == 0 {
// Use the path from the buffer
mode = mode_t(preRenameAttributes.mode)
if preRenameAttributes.fileType == VREG.rawValue && !(preRenameAttributes.nlink > 1) {
// Copy the contents of the getattrlist buffer for the string into a Swift String
withUnsafePointer(to: preRenameAttributes.fullPathBuf) { ptrToTuple in
// The length of the string is passed back to us in the same struct as the C string itself
// n.b. Length includes the null-termination byte. Use this size for the buffer.
let length = Int(preRenameAttributes.fullPathAttr.attr_length)
ptrToTuple.withMemoryRebound(to: CChar.self, capacity: length) { pointer in
newPath = String(cString: pointer)
}
// Copy the contents of the getattrlist buffer for the string into a Swift String
withUnsafePointer(to: preRenameAttributes.fullPathBuf) { ptrToTuple in
// The length of the string is passed back to us in the same struct as the C string itself
// n.b. Length includes the null-termination byte. Use this size for the buffer.
let length = Int(preRenameAttributes.fullPathAttr.attr_length)
ptrToTuple.withMemoryRebound(to: CChar.self, capacity: length) { pointer in
newPath = String(cString: pointer)
}
}
} else if (errno != ENOENT) && (errno != ENAMETOOLONG) {
} else if (errno != ENOENT) && (errno != ENAMETOOLONG) && (errno != ENOTCAPABLE) {
throw CocoaError.errorWithFilePath(inPath, errno: errno, reading: false)
}
#else
Expand Down Expand Up @@ -595,7 +594,7 @@ private func writeToFileAux(path inPath: borrowing some FileSystemRepresentable
#if FOUNDATION_FRAMEWORK
var attrs = attrlist(bitmapcount: u_short(ATTR_BIT_MAP_COUNT), reserved: 0, commonattr: attrgroup_t(ATTR_CMN_FULLPATH), volattr: .init(), dirattr: .init(), fileattr: .init(), forkattr: .init())
var buffer = FullPathAttributes()
let result = fgetattrlist(fd, &attrs, &buffer, MemoryLayout<FullPathAttributes>.size, .init(FSOPT_NOFOLLOW))
let result = fgetattrlist(fd, &attrs, &buffer, MemoryLayout<FullPathAttributes>.size, .init(FSOPT_NOFOLLOW | FSOPT_UNIQUE))
// Compare the last one to this one
if result == 0 {
withUnsafePointer(to: buffer.fullPathBuf) { ptrToTuple in
Expand Down