The vulnerability is at https://github.com/openstack/storlets/blob/928de77bac448c9bc04a274c494608ce7190563a/storlets/gateway/gateways/docker/gateway.py#L320C20-L320C30
Take gateway.py#L320C20-L320C30 for example:
```
with open(cache_target_path, 'wb') as fn:
for data in data_iter:
fn.write(data)
if not is_storlet:
if not perm:
perm = '0600'
os.chmod(cache_target_path, int(perm, 8))
```
When a file is first written and then its permissions are later changed using chmod, there exists a potential security risk known as a time-of-check to time-of-use (TOCTOU) attack. In this type of attack, an attacker exploits the time window between when the file is initially written and when its permissions are modified. During this time window, the attacker may gain access to the file.
Fix proposed to branch: master
Review: https:/