# Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

**Stack:** Python

- Prevalence: Moyenne 3 langages couverts
- Impact: Élevé 4 règles de sévérité élevée
- Prevention: Documentée 6 exemples de correctifs

**OWASP:** Insecure Design (A04:2021-Insecure Design) - #4

## Description

This can have security implications when the expected synchronization is in security-critical code, such as recording whether a user is authenticated or modifying important state information that should not be influenced by an outsider.

## Prevention

Stratégies de prévention pour Race Condition basées sur 1 règles de détection Shoulder.

### Python

Use locks for shared data and atomic operations for file access

## Warning Signs

- [MEDIUM] potential race conditions in concurrent Python code

## Consequences

- Modification des données de l'application
- DoS
- Exécuter du code non autorisé
- Contourner le mécanisme de protection

## Mitigations

- Utilisez des primitives de synchronisation appropriées comme verrous, mutex ou sémaphores
- Minimisez la quantité de code dans les sections critiques
- Utilisez des structures de données thread-safe lorsque c'est possible

## Detection

- Total rules: 6
- Languages: go, javascript, typescript, python

## Rules by Language

### Python (1 rules)

- **Potential Race Condition** [MEDIUM]: Detects potential race conditions in concurrent Python code.

Common race condition patterns:
1. Global variables accessed from threads without locking
2. TOCTOU (Time-of-check Time-of-use) file operations
3. Shared data structures modified in threads without synchronization
4. Check-then-act patterns without atomicity

Python's GIL doesn't prevent all race conditions, especially with I/O
operations and multi-process code.
  - Remediation: Use locks for shared data and atomic operations for file access.

```python
import threading
import os

# Use locks for shared data
lock = threading.Lock()
with lock:
    counter += 1

# Atomic file creation (no TOCTOU)
try:
    fd = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)
    os.close(fd)
except FileExistsError:
    pass

# Or use makedirs with exist_ok
os.makedirs(path, exist_ok=True)
```

Learn more: https://shoulder.dev/learn/python/cwe-362/race-condition