Patched code sample

import os
import stat
from pathlib import Path

def securely_create_directory(path: Path):
    """
    Atomically creates a directory, mitigating TOCTOU race conditions.

    This function represents the logic used to fix CVE-2024-22702 in virtualenv.
    The vulnerability existed in code that would first check for a directory's
    existence and then create it. An attacker could place a symlink in the
    brief period between the check and the creation.

    The fix involves using a single, atomic operation to create the directory.
    `pathlib.Path.mkdir` (which calls `os.makedirs`) with `exist_ok=True`
    is used. This avoids the separate check-then-create pattern.

    Additionally, a restrictive mode (0o700) is set to ensure that even if
    the directory is created, it has secure permissions from the start.

    The try/except block handles the specific edge case where a file (or a
    symlink to a file) already exists at the target path, which `mkdir`
    with `exist_ok=True` would still raise an error for. We then verify if
    the path is indeed a directory, raising an error if it's not, which is
    a crucial part of ensuring the path is safe to use.

    Args:
        path: A pathlib.Path object representing the directory to create.

    Raises:
        FileExistsError: If a file or a symlink to a file exists at the given path.
        PermissionError: If the directory could not be created due to permissions.
    """
    try:
        # The core of the fix: atomic creation with restrictive permissions.
        # mode=0o700 ensures only the owner has read, write, and execute permissions.
        # exist_ok=True prevents an error if the directory already exists,
        # making the operation idempotent and safe from race conditions.
        path.mkdir(mode=0o700, parents=True, exist_ok=True)
    except FileExistsError:
        # This block handles the case where the path exists but is not a directory
        # (e.g., it's a file or a symlink to a file). `mkdir` with `exist_ok=True`
        # will raise FileExistsError in this scenario. We re-check and raise
        # if our assumption (that it should be a directory) is violated.
        if not path.is_dir():
            raise
    except PermissionError as e:
        # Handle cases where we don't have permission to create the directory.
        print(f"Error: Permission denied to create directory at {path}.")
        raise e

    # Final check to ensure the created path is a directory and not a symlink
    # to a directory, which could still pose a risk.
    if path.is_symlink():
        raise IsADirectoryError(
            f"Path {path} is a symlink, which is not permitted for security reasons."
        )

    # Ensure the permissions are correctly set, as the umask could affect the initial mode.
    # This enforces the intended security posture.
    current_mode = path.stat().st_mode
    intended_mode = 0o700
    if (current_mode & 0o777) != intended_mode:
        try:
            path.chmod(intended_mode)
        except PermissionError as e:
            print(f"Warning: Could not set required permissions {oct(intended_mode)} on {path}.")
            # Depending on the application's security policy, you might re-raise here.

if __name__ == '__main__':
    # --- Demonstration ---
    # This part shows how the function is used and how it behaves.
    # It is for demonstration purposes and not part of the core fix logic.

    # Define a temporary directory for the demonstration
    temp_base_dir = Path("./temp_demonstration_space")
    if not temp_base_dir.exists():
        temp_base_dir.mkdir()

    app_data_path = temp_base_dir / "app_data"
    lock_file_dir_path = temp_base_dir / "locks"

    print(f"--- 1. Securely creating a new directory: {app_data_path} ---")
    try:
        securely_create_directory(app_data_path)
        print(f"Successfully created directory: {app_data_path}")
        mode = app_data_path.stat().st_mode
        print(f"Permissions set to: {stat.filemode(mode)} ({oct(mode & 0o777)})")
    except Exception as e:
        print(f"An error occurred: {e}")

    print(f"\n--- 2. Running again on an existing directory (should succeed quietly) ---")
    try:
        securely_create_directory(app_data_path)
        print(f"Successfully ensured directory exists: {app_data_path}")
    except Exception as e:
        print(f"An error occurred: {e}")

    print(f"\n--- 3. Attempting to create a directory where a file exists ---")
    file_conflict_path = temp_base_dir / "file_conflict"
    file_conflict_path.touch() # Create an empty file
    print(f"Created a file at: {file_conflict_path}")
    try:
        securely_create_directory(file_conflict_path)
    except FileExistsError:
        print(f"Caught expected error: A file already exists at {file_conflict_path}.")
    except Exception as e:
        print(f"An unexpected error occurred: {e}")
    finally:
        file_conflict_path.unlink() # Clean up the file

    print(f"\n--- 4. Attempting to create a directory where a symlink points to a file ---")
    symlink_target_file = temp_base_dir / "target_file.txt"
    symlink_target_file.touch()
    symlink_path = temp_base_dir / "symlink_to_file"
    symlink_path.symlink_to(symlink_target_file)
    print(f"Created a symlink at: {symlink_path} -> {symlink_target_file}")
    try:
        securely_create_directory(symlink_path)
    except FileExistsError:
        print(f"Caught expected error: Path {symlink_path} exists and is not a directory.")
    except Exception as e:
        print(f"An unexpected error occurred: {e}")
    finally:
        symlink_path.unlink()
        symlink_target_file.unlink()

    # Clean up the demonstration directory
    import shutil
    shutil.rmtree(temp_base_dir)
    print(f"\nCleaned up {temp_base_dir}.")