notify-rs/notify

TOCTOU bug when adding a watcher

matklad opened this issue · 1 comments

See user visible bug report here: lomirus/live-server#73

I believe the following code is incorrect:

for entry in WalkDir::new(path)
.follow_links(true)
.into_iter()
.filter_map(filter_dir)
{
self.add_single_watch(entry.path().to_path_buf(), is_recursive, watch_self)?;
watch_self = false;
}

Here, we use walkdir to list paths, and then use inotify to watch the path. The problem is that between the moment that walkdir returned us a PathBut, and us giving this path to inotify to watch, the path can get deleted. This results in inotify returning a FileNotFound IO error, and notify bailing out with it all the way up to RecommendedWatcher::watch.

The expected behavior is for notify to either report removal for this path, or not report anything at all, but clearly not to crash.

EDIT: to clarify, the path in question is not the root path which we ask to watch, but some subdirectory of it