rust-lang/rust-clippy

TOCTOU: call `Path::metadata` after `Path::exists`

Open

#17,158 opened on Jun 4, 2026

View on GitHub
 (2 comments) (1 reaction) (1 assignee)Rust (1,391 forks)batch import
A-lintgood first issue

Repository metrics

Stars
 (10,406 stars)
PR merge metrics
 (Avg merge 16d 6h) (79 merged PRs in 30d)

Description

What it does

Detect when calling Path::exists followed by another operation that would cause a new syscall to be used on the path, like Path::metadata.

Advantage

Remove a source of TOCTOU bugs.

Drawbacks

No response

Example

if new_path.exists() {
    let md = new_path.metadata().unwrap();

Could be written as:

if let Ok(md) = new_path.metadata() {

Comparison with existing lints

No response

Additional Context

https://github.com/uutils/coreutils/pull/11711/changes

Contributor guide

Research direction
Implement a new lint that detects TOCTOU pattern: calling `Path::exists` followed by `Path::metadata`. Use Clippy's lint infrastructure to register the lint, create a diagnostic that suggests using `metadata` directly, and add tests in the `tests/` directory.
Tech stack
rust
Domain
developer experience
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Rust
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65