#357: fix TOCTOU race in durable_place by opening file before checking

Author: VasilevNStas

lib/baza-rb.rb

@@ -298,26 +298,30 @@ def durable_place(pname, file)
     raise(RuntimeError, 'The "pname" of the durable is nil') if pname.nil?
     raise(RuntimeError, 'The "pname" of the durable may not be empty') if pname.empty?
     raise(RuntimeError, 'The "file" of the durable is nil') if file.nil?
-    raise(RuntimeError, "The file '#{file}' is absent") unless File.exist?(file)
-    if File.size(file) > 1024
-      raise(
-        RuntimeError,
-        "The file '#{file}' is too big (#{File.size(file)} bytes) for durable_place(), use durable_save() instead"
-      )
-    end
     id = nil
-    elapsed(@loog, level: Logger::INFO) do
-      id = post(
-        home.append('durable-place'),
-        {
-          'pname' => pname,
-          'file' => File.basename(file),
-          'zip' => File.open(file, 'rb')
-        }
-      ).headers['X-Zerocracy-DurableId'].to_i
-      throw(:"Durable ##{id} (#{file}, #{File.size(file)} bytes) placed for job \"#{pname}\" at #{@host}")
+    File.open(file, 'rb') do |f|
+      raise(RuntimeError, "The file '#{file}' is absent") unless f.stat.file?
+      if f.size > 1024
+        raise(
+          RuntimeError,
+          "The file '#{file}' is too big (#{f.size} bytes) for durable_place(), use durable_save() instead"
+        )
+      end
+      elapsed(@loog, level: Logger::INFO) do
+        id = post(
+          home.append('durable-place'),
+          {
+            'pname' => pname,
+            'file' => File.basename(file),
+            'zip' => f
+          }
+        ).headers['X-Zerocracy-DurableId'].to_i
+        throw(:"Durable ##{id} (#{file}, #{f.size} bytes) placed for job \"#{pname}\" at #{@host}")
+      end
     end
     id
+  rescue Errno::ENOENT
+    raise(RuntimeError, "The file '#{file}' is absent")
   end
 
   # Save a single durable from local file to server.

test/test_baza_edge.rb

@@ -49,6 +49,20 @@ def test_durable_place
     end
   end
 
+  def test_durable_place_rejects_symlink_to_non_regular_file
+    WebMock.disable_net_connect!
+    Dir.mktmpdir do |dir|
+      link = File.join(dir, 'target.bin')
+      File.symlink('/dev/null', link)
+      baza = fake_baza(compress: false)
+      error =
+        assert_raises(RuntimeError) do
+          baza.durable_place('simple', link)
+        end
+      assert_includes(error.message, 'absent')
+    end
+  end
+
   def test_real_http
     WebMock.enable_net_connect!
     assert_equal(