TOCTOU: File deletion followed by file creation

What it does

Detect when a file is being deleted and then the same file path is used to create a new file. This is a classic source of Time Of Check, Time Of Use bugs.

Advantage

The recommended code deletes and recreates an empty file in a single syscall, meaning that the act of creation acts as the check, avoiding TOCTOU bugs.

Drawbacks

No response

Example

We should detect when an argument to std::fs::remove_file is used later to create a File:

    let path = "foo";
    fs::remove_file(path)?;
    fs::File::create(path)?;

We should detect when string literals are used too:

    fs::remove_file("foo")?;
    fs::File::create("foo")?;

Could be written as:

    let _ = fs::OpenOptions::new()
        .write(true)
        .create_new(true)
        .open(path)?;

Comparison with existing lints

No response

Additional Context

This is the cause for CVE 2026-35355 in uutils: https://corrode.dev/blog/bugs-rust-wont-catch/#case-study-cve-2026-35355

https://github.com/uutils/coreutils/commit/b5bbabc18a1121908848d836f869a4e98eb63886#diff-bcf6f1535f9c0064879a5dc2d41d760d17217f2767b52f972c595e28ab5c2d72R825-R840

Start by reviewing existing rust-clippy filesystem-operation lints and the linked uutils change. Use the two Rust examples as the initial cases: a path passed to remove_file, including a string literal, then reused by File::create. Done means the lint reliably identifies that sequence and recognizes the create_new OpenOptions form as the safer alternative.