security: TOCTOU in file transfer between stat() and read_bytes()

[nathanschram]

Description

In the file transfer module, there is a time-of-check-to-time-of-use (TOCTOU) gap between calling stat() to check file size and read_bytes() to read the file content. A file that grows between these two calls (e.g. an actively written log file) could exceed the size limit and cause unexpected memory consumption.

Affected files

• src/untether/telegram/file_transfer.py:584-592

Impact

Memory spike if a file grows between size check and read. Low practical risk since file transfers typically target static files.

Recommended fix

Use streaming read with an explicit size limit:

with open(path, "rb") as f:
    content = f.read(max_size + 1)
    if len(content) > max_size:
        raise ValueError(f"File exceeds {max_size} byte limit")

Severity

LOW — requires specific timing conditions with growing files.