# Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

**Stack:** Python

- Prevalence: 보통 3개 언어 지원
- Impact: 높음 4개의 높은 심각도 규칙
- Prevention: 문서화됨 6개의 수정 예시

**OWASP:** Insecure Design (A04:2021-Insecure Design) - #4

## Description

This can have security implications when the expected synchronization is in security-critical code, such as recording whether a user is authenticated or modifying important state information that should not be influenced by an outsider.

## Prevention

1개의 Shoulder 탐지 규칙을 기반으로 한 Race Condition 예방 전략.

### Python

Use locks for shared data and atomic operations for file access

## Warning Signs

- [MEDIUM] potential race conditions in concurrent Python code

## Consequences

- 애플리케이션 데이터 수정
- DoS
- 승인되지 않은 코드 실행
- 보호 메커니즘 우회

## Mitigations

- lock, mutex, semaphore 등 적절한 동기화 기본 요소를 사용하세요
- 임계 영역 내의 코드 양을 최소화하세요
- 가능하면 스레드 안전한 자료 구조를 사용하세요

## Detection

- Total rules: 6
- Languages: go, javascript, typescript, python

## Rules by Language

### Python (1 rules)

- **Potential Race Condition** [MEDIUM]: Detects potential race conditions in concurrent Python code.

Common race condition patterns:
1. Global variables accessed from threads without locking
2. TOCTOU (Time-of-check Time-of-use) file operations
3. Shared data structures modified in threads without synchronization
4. Check-then-act patterns without atomicity

Python's GIL doesn't prevent all race conditions, especially with I/O
operations and multi-process code.
  - Remediation: Use locks for shared data and atomic operations for file access.

```python
import threading
import os

# Use locks for shared data
lock = threading.Lock()
with lock:
    counter += 1

# Atomic file creation (no TOCTOU)
try:
    fd = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)
    os.close(fd)
except FileExistsError:
    pass

# Or use makedirs with exist_ok
os.makedirs(path, exist_ok=True)
```

Learn more: https://shoulder.dev/learn/python/cwe-362/race-condition