Potential TOCTTOU (Time-of-check to time-of-use) issue in file existence check
Open
type: bug
- Dominant language
- Haskell
- Stars
- 1.7k
- Forks
- 750
- Avg merge
- 4d 3h
- Merged PRs (30d)
- 28
Description
I'm looking at the code related to reading `cabal.project` files and I noticed some checks for file existence, [like here](https://github.com/haskell/cabal/blob/master/cabal-install/src/Distribution/Client/ProjectConfig.hs#L515).
These seem like [TOCTTOU](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) issues to me. Is there a reason not to rely on a "file not found error" or similar to fall back to the case of the file not existing?
I haven't looked into `monitorFiles` so my impression could very well be wrong.
Contributor guide
Assessment
This issue has not been assessed yet.