Secure cache directory creation to prevent TOCTOU race conditions (#283)

Modified `Path.mkdir()` calls in `qwen3_embed/common/utils.py` and
`qwen3_embed/common/model_management.py` to explicitly set `mode=0o700`.
This prevents a Time-of-Check to Time-of-Use (TOCTOU) vulnerability
where temporary directories were created with default umask permissions
and subsequently restricted using a `chmod` call, leaving a brief window
where unauthorized processes could interact with the directory contents.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

Author: n24q02m

qwen3_embed/common/model_management.py

@@ -218,7 +218,7 @@ def _collect_file_metadata(
     def _save_file_metadata(cls, model_dir: Path, meta: dict[str, dict[str, int | str]]) -> None:
         try:
             if not model_dir.exists():
-                model_dir.mkdir(parents=True, exist_ok=True)
+                model_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
             (model_dir / cls.METADATA_FILE).write_text(json.dumps(meta))
         except (OSError, ValueError) as e:
             logger.exception(e)
@@ -395,7 +395,7 @@ def retrieve_model_gcs(
         if model_tmp_dir.exists():
             shutil.rmtree(model_tmp_dir)
 
-        cache_tmp_dir.mkdir(parents=True, exist_ok=True)
+        cache_tmp_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
         with contextlib.suppress(OSError):
             os.chmod(cache_tmp_dir, 0o700)
 

qwen3_embed/common/utils.py

@@ -85,7 +85,7 @@ def define_cache_dir(cache_dir: str | None = None) -> Path:
             cache_path = base_path / "qwen3_embed"
     else:
         cache_path = Path(cache_dir)
-    cache_path.mkdir(parents=True, exist_ok=True)
+    cache_path.mkdir(mode=0o700, parents=True, exist_ok=True)
 
     with contextlib.suppress(OSError):
         cache_path.chmod(0o700)