refactor: avoid TOCTOU by holding open output dir

Author: vados-cosmonic

crates/wkg/src/main.rs

@@ -1,13 +1,13 @@
 use std::{io::Seek, path::PathBuf};
 
-use anyhow::{ensure, Context};
+use anyhow::{Context, ensure};
 use clap::{Args, Parser, Subcommand, ValueEnum};
 use futures_util::TryStreamExt;
 use tokio::io::AsyncWriteExt;
 use tracing::level_filters::LevelFilter;
 use wasm_pkg_client::{
-    caching::{CachingClient, FileCache},
     Client, PublishOpts,
+    caching::{CachingClient, FileCache},
 };
 use wasm_pkg_common::{
     self,
@@ -311,21 +311,61 @@ impl GetArgs {
         tracing::debug!(?release, "Fetched release details");
 
         let output_trailing_slash = self.output.as_os_str().to_string_lossy().ends_with('/');
-        let parent_dir = if output_trailing_slash {
-            let parent_dir = self.output.as_path();
-            if !tokio::fs::try_exists(parent_dir).await? {
-                tokio::fs::create_dir_all(parent_dir).await
-                    .context("Failed to create output dir")?
+        // SAFETY: to avoid TOCTOU bugs, we open the directory and keep it open
+        let _parent_dir: tokio::fs::File;
+        let parent_dir_path = if output_trailing_slash {
+            let parent_dir_path = self.output.as_path();
+            if !tokio::fs::try_exists(parent_dir_path).await? {
+                tokio::fs::create_dir_all(parent_dir_path)
+                    .await
+                    .context("Failed to create output dir")?;
+                _parent_dir = tokio::fs::OpenOptions::new()
+                    .read(true)
+                    .write(true)
+                    .create_new(true)
+                    .open(parent_dir_path)
+                    .await
+                    .with_context(|| {
+                        format!("failed to create new dir @ [{}]", parent_dir_path.display())
+                    })?;
+                parent_dir_path
+            } else {
+                _parent_dir = tokio::fs::OpenOptions::new()
+                    .read(true)
+                    .write(true)
+                    .create(false)
+                    .open(parent_dir_path)
+                    .await
+                    .with_context(|| {
+                        format!(
+                            "failed to open existing dir @ [{}]",
+                            parent_dir_path.display()
+                        )
+                    })?;
+                parent_dir_path
             }
-            parent_dir
         } else {
-            self.output
+            let parent_dir_path = self
+                .output
                 .parent()
-                .context("Failed to resolve output parent dir")?
+                .context("Failed to resolve non-trailing-slash output parent dir")?;
+            _parent_dir = tokio::fs::OpenOptions::new()
+                .read(true)
+                .write(true)
+                .create(false)
+                .open(parent_dir_path)
+                .await
+                .with_context(|| {
+                    format!(
+                        "failed to open existing parent dir @ [{}]",
+                        parent_dir_path.display()
+                    )
+                })?;
+            parent_dir_path
         };
 
         let (tmp_file, tmp_path) =
-            tempfile::NamedTempFile::with_prefix_in(".wkg-get", parent_dir)?.into_parts();
+            tempfile::NamedTempFile::with_prefix_in(".wkg-get", parent_dir_path)?.into_parts();
         tracing::debug!(?tmp_path, "Created temporary file");
 
         let mut content_stream = client.get_content(&package, &release).await?;