haskell / haskell/cabal

Potential TOCTTOU (Time-of-check to time-of-use) issue in file existence check

Open
#7,150 3 comments 0 reactions 0 assignees View on GitHub
type: bug
Dominant language
Haskell
Stars
1.7k
Forks
750
Avg merge
4d 3h
Merged PRs (30d)
28

Description

I'm looking at the code related to reading `cabal.project` files and I noticed some checks for file existence, [like here](https://github.com/haskell/cabal/blob/master/cabal-install/src/Distribution/Client/ProjectConfig.hs#L515).
These seem like [TOCTTOU](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) issues to me. Is there a reason not to rely on a "file not found error" or similar to fall back to the case of the file not existing?
I haven't looked into `monitorFiles` so my impression could very well be wrong.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.