From 8c573314d66ab917b89371a5f9519ddef3c75a7e Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 28 Apr 2026 11:16:18 +0000
Subject: [PATCH] fix(about): resolve TOCTOU vulnerability by migrating to
 async file I/O

Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>
---
 app/about/page.tsx | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/app/about/page.tsx b/app/about/page.tsx
index 243706b..66203f9 100644
--- a/app/about/page.tsx
+++ b/app/about/page.tsx
@@ -3,7 +3,7 @@
  * Reads content from content/about.md (frontmatter + markdown body).
  */
 
-import { readFileSync } from 'fs';
+import { promises as fsPromises } from 'fs';
 import { join } from 'path';
 import yaml from 'js-yaml';
 import Image from 'next/image';
@@ -20,12 +20,15 @@ interface AboutFrontmatter {
   gear?: string[];
 }
 
-function getAboutContent() {
+async function getAboutContent() {
   const filePath = join(process.cwd(), 'content', 'about.md');
-  if (!require('fs').existsSync(filePath)) {
+  let raw: string;
+
+  try {
+    raw = await fsPromises.readFile(filePath, 'utf-8');
+  } catch {
     return { meta: {} as AboutFrontmatter, body: '' };
   }
-  const raw = readFileSync(filePath, 'utf-8');
 
   let meta = {} as AboutFrontmatter;
   let body = raw;
@@ -44,7 +47,7 @@ function getAboutContent() {
 }
 
 export default async function AboutPage() {
-  const { meta, body } = getAboutContent();
+  const { meta, body } = await getAboutContent();
 
   // Fetch ThumbHash for portrait placeholder
   const portraitAsset = meta.portrait ? await immich.getAssetInfo(meta.portrait) : null;