asf-tooling opened a new issue, #1013:
URL: https://github.com/apache/tooling-trusted-releases/issues/1013
**ASVS Level(s):** [L2-only]
**Description:**
### Summary
Project creation uses check-then-create pattern with acknowledged race
condition (TODO comment in code). Existence check is performed, then project
insert. Concurrent requests could attempt to create the same project between
the existence check and insert. Database unique constraint prevents duplication
but error handling may not be user-friendly.
### Details
Affected locations in `atr/storage/writers/project.py`:
- Lines 132-165: Project creation with check-then-create pattern
- Lines 135-137: Existence check
- Lines 127-160: Insert operation
The TODO comment at line 135 acknowledges: "This is a race condition, but
it's unlikely to be hit in practice." However, concurrent project creation
attempts could trigger IntegrityError.
### Recommended Remediation
**Option 1 (Recommended):** Catch IntegrityError - Skip existence check,
rely on database constraint, catch IntegrityError and convert to user-friendly
AccessError:
```python
try:
# Skip existence check, attempt insert directly
await self._insert_project(project_data)
except IntegrityError:
raise storage.AccessError(f"Project {project_key} already exists")
```
**Option 2:** INSERT ON CONFLICT - Use SQLite INSERT ON CONFLICT DO NOTHING
with RETURNING clause to atomically check and insert:
```python
result = await conn.execute(
"INSERT INTO projects (...) VALUES (...) "
"ON CONFLICT DO NOTHING RETURNING *"
)
if not result:
raise storage.AccessError(f"Project {project_key} already exists")
```
**Option 3:** Add `begin_immediate()` before existence check to acquire
write lock.
### Acceptance Criteria
- [ ] Race condition is eliminated
- [ ] Concurrent creation attempts are handled gracefully
- [ ] User-friendly error message on conflict
- [ ] Test cases verify concurrent creation handling
- [ ] Unit test verifying the fix
### References
- Source reports: L2:2.3.3.md, L2:2.3.4.md
- Related findings: FINDING-030
- ASVS sections: 2.3.3, 2.3.4
### Priority
Medium
---
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
