From 4e654acebf6e26532ee2f08fa424a8940e3b15e2 Mon Sep 17 00:00:00 2001 From: AndyMik90 Date: Fri, 13 Mar 2026 20:25:55 +0100 Subject: [PATCH] fix(security): resolve CodeQL file-system race in ensureOnboardingComplete Replace existsSync + readFileSync pattern with direct readFileSync wrapped in try/catch for ENOENT. Eliminates the TOCTOU race condition flagged by CodeQL (js/file-system-race). Co-Authored-By: Claude Opus 4.6 --- .../src/main/terminal/cli-integration-handler.ts | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/apps/desktop/src/main/terminal/cli-integration-handler.ts b/apps/desktop/src/main/terminal/cli-integration-handler.ts index d14941a8..b1be0f60 100644 --- a/apps/desktop/src/main/terminal/cli-integration-handler.ts +++ b/apps/desktop/src/main/terminal/cli-integration-handler.ts @@ -910,11 +910,17 @@ function ensureOnboardingComplete(configDir: string): void { ); const claudeJsonPath = path.join(expandedDir, '.claude.json'); - if (!fs.existsSync(claudeJsonPath)) { - return; // No .claude.json yet — Claude Code will create it during auth + // Read directly instead of existsSync + readFileSync to avoid TOCTOU race (CodeQL js/file-system-race) + let content: string; + try { + content = fs.readFileSync(claudeJsonPath, 'utf-8'); + } catch (readErr) { + if ((readErr as NodeJS.ErrnoException).code === 'ENOENT') { + return; // No .claude.json yet — Claude Code will create it during auth + } + throw readErr; } - const content = fs.readFileSync(claudeJsonPath, 'utf-8'); const config = JSON.parse(content); if (typeof config !== 'object' || config === null || Array.isArray(config)) {