[PR #446] [MERGED] Avoid pre-stat file checks #532

New issue

Closed

opened 2026-02-26 22:31:24 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 22:31:24 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/446
Author: @rudrankriyam
Created: 2/8/2026
Status: ✅ Merged
Merged: 2/8/2026
Merged by: @rudrankriyam

Base: main ← Head: chore/cleanup-toctou-checks

📝 Commits (1)

d131361 refactor(cli): avoid pre-stat file checks

📊 Changes

5 files changed (+42 additions, -18 deletions)

View changed files

📝 internal/auth/keychain.go (+9 -2)
📝 internal/cli/gamecenter/game_center_matchmaking.go (+9 -2)
📝 internal/cli/migrate/migrate.go (+12 -8)
📝 internal/cli/testflight/testflight_sync.go (+3 -4)
📝 internal/cli/xcodecloud/xcode_cloud_extras.go (+9 -2)

📄 Description

Summary

switch JSON payload reads to open/stat/read to avoid TOCTOU
validate key files using the opened fd before reading
remove redundant metadata dir pre-checks and defer output-path dir errors to rename

Test plan

make format
make lint
make test

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/446 **Author:** [@rudrankriyam](https://github.com/rudrankriyam) **Created:** 2/8/2026 **Status:** ✅ Merged **Merged:** 2/8/2026 **Merged by:** [@rudrankriyam](https://github.com/rudrankriyam) **Base:** `main` ← **Head:** `chore/cleanup-toctou-checks` --- ### 📝 Commits (1) - [`d131361`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/d13136117975f9a0c6b14bc312bf9d4e4eaaa379) refactor(cli): avoid pre-stat file checks ### 📊 Changes **5 files changed** (+42 additions, -18 deletions) <details> <summary>View changed files</summary> 📝 `internal/auth/keychain.go` (+9 -2) 📝 `internal/cli/gamecenter/game_center_matchmaking.go` (+9 -2) 📝 `internal/cli/migrate/migrate.go` (+12 -8) 📝 `internal/cli/testflight/testflight_sync.go` (+3 -4) 📝 `internal/cli/xcodecloud/xcode_cloud_extras.go` (+9 -2) </details> ### 📄 Description ## Summary - switch JSON payload reads to open/stat/read to avoid TOCTOU - validate key files using the opened fd before reading - remove redundant metadata dir pre-checks and defer output-path dir errors to rename ## Test plan - make format - make lint - make test --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>