While running the Redfish Service Validator, I encountered issues related to Time-of-Check to Time-of-Use (TOCTOU) on dynamic resources such as session URIs and log entries. The validator checks for the existence of a resource (e.g., a session or a log entry), but by the time it attempts to access the same URI, the resource may have been deleted, expired, or overwritten, resulting in a 404 Not Found error.
Steps to Reproduce:
- Start the Redfish Service Validator against a service with dynamic resources (e.g., sessions, log entries).
- Ensure at least one session or log entry exists initially.
- Allow the session to expire or be deleted, or allow log entries to be overwritten or deleted during the validation process.
- Observe that the validator attempts to access the nonexistent resource URI and receives a 404 error.
Expected Behavior:
The validator should handle dynamic resources gracefully, recognizing that resources like sessions and log entries may be deleted, expire, or be overwritten between checks and accesses, and should not treat 404 errors in these cases as validation failures.
Actual Behavior:
The validator reports 404 Not Found errors when attempting to access session or log entry URIs that have been deleted, expired, or overwritten after the initial check.
Additional Context:
This issue is due to a TOCTOU (Time-of-Check to Time-of-Use) , which is common with dynamic resources. Handling such cases would improve the robustness of the validator.
While running the Redfish Service Validator, I encountered issues related to Time-of-Check to Time-of-Use (TOCTOU) on dynamic resources such as session URIs and log entries. The validator checks for the existence of a resource (e.g., a session or a log entry), but by the time it attempts to access the same URI, the resource may have been deleted, expired, or overwritten, resulting in a 404 Not Found error.
Steps to Reproduce:
Expected Behavior:
The validator should handle dynamic resources gracefully, recognizing that resources like sessions and log entries may be deleted, expire, or be overwritten between checks and accesses, and should not treat 404 errors in these cases as validation failures.
Actual Behavior:
The validator reports 404 Not Found errors when attempting to access session or log entry URIs that have been deleted, expired, or overwritten after the initial check.
Additional Context:
This issue is due to a TOCTOU (Time-of-Check to Time-of-Use) , which is common with dynamic resources. Handling such cases would improve the robustness of the validator.