The Unseen Dangers: Bugs Rust *Still* Won't Catch in 2026

#[derive(Debug, PartialEq)]
enum AccessLevel {
    Guest,
    User,
    Admin,
}

#[derive(Debug)]
struct User {
    id: u32,
    username: String,
    is_active: bool,
    access: AccessLevel,
}

// Imagine this function is part of a critical authorization middleware
fn check_resource_access(user: &User, required_level: AccessLevel) -> bool {
    // A seemingly innocent logic flaw:
    // If the user is active, we might *always* grant them access without checking their actual level
    // under specific conditions that were misunderstood during design.
    if user.is_active && user.access == AccessLevel::Admin {
        println!("User {} (ID: {}) has admin access.", user.username, user.id);
        true // Admin always gets access, as expected
    } else if user.is_active && required_level == AccessLevel::Guest {
        // BUG: This line implicitly grants access to any active user for 'Guest' resources.
        // It doesn't check if user.access is *at least* Guest, but rather if *required_level* is Guest.
        // A non-admin active user might unintentionally get access to something only meant for true 'User' roles
        // if another part of the system incorrectly requests AccessLevel::Guest for a sensitive resource.
        println!("User {} (ID: {}) has guest access (active user).", user.username, user.id);
        true
    } else if user.is_active && user.access >= required_level { // Placeholder for actual comparison
        // Assuming an `impl PartialOrd for AccessLevel` exists for a proper comparison
        println!("User {} (ID: {}) access granted based on level.", user.username, user.id);
        true
    } else {
        println!("User {} (ID: {}) access denied.", user.username, user.id);
        false
    }
}

// For demonstration, let's assume we implement PartialOrd for AccessLevel
impl PartialOrd for AccessLevel {
    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
        Some(self.cmp(other))
    }
}

impl Ord for AccessLevel {
    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
        (*self as u8).cmp(&(*other as u8))
    }
}

fn main() {
    let admin_user = User {
        id: 1,
        username: "root".to_string(),
        is_active: true,
        access: AccessLevel::Admin,
    };
    let regular_user = User {
        id: 2,
        username: "alice".to_string(),
        is_active: true,
        access: AccessLevel::User,
    };
    let inactive_user = User {
        id: 3,
        username: "bob".to_string(),
        is_active: false,
        access: AccessLevel::User,
    };

    println!("--- Test Cases ---");
    // Expected: Admin can access Admin resource
    assert!(check_resource_access(&admin_user, AccessLevel::Admin));
    // Expected: Admin can access User resource
    assert!(check_resource_access(&admin_user, AccessLevel::User));
    // Expected: Regular user cannot access Admin resource
    assert!(!check_resource_access(&regular_user, AccessLevel::Admin));
    // Expected: Regular user can access User resource
    assert!(check_resource_access(&regular_user, AccessLevel::User));

    // The logic flaw:
    // What if a critical resource that should require AccessLevel::User is mistakenly configured to require AccessLevel::Guest?
    // The current logic *incorrectly* allows any active user, even a newly registered one with Guest access,
    // to access resources meant for `AccessLevel::User` if the `required_level` is accidentally set to `Guest`.
    // The `else if user.is_active && required_level == AccessLevel::Guest` branch is too broad.
    // It should explicitly check `user.access >= required_level` for *all* cases where `required_level` isn't `Admin`.
    println!("Checking for flaw: Regular user accessing a *mistakenly* Guest-level sensitive resource...");
    // Let's create a scenario where a sensitive resource is accidentally tagged `AccessLevel::Guest`
    // but should logically require `AccessLevel::User`.
    let sensitive_guest_resource_level = AccessLevel::Guest; // This is the mistake in configuration!
    // A regular user, even though they have `AccessLevel::User`, *should* be denied if the resource is
    // so sensitive it demands a higher check, but the function's logic fails here.
    // Specifically, if the intent was `user.access >= required_level` for *all* non-admin, non-guest,
    // the current `if user.is_active && required_level == AccessLevel::Guest` branch short-circuits this.
    // A more precise `AccessLevel` enum for example could have `Unregistered` and `Guest`,
    // where `Guest` implies some basic level.
    // The current example highlights a misinterpretation of "active user can access guest resources".
    // It should be: "active user *with sufficient access level* can access guest resources."
    assert!(check_resource_access(&regular_user, sensitive_guest_resource_level)); // This assertion *passes* due to the flaw.
    println!("Flaw demonstrated: regular_user (User level) gained access to a resource requiring Guest level. This could be an authorization bypass if the resource was mislabeled.");

    // Expected: Inactive user denied everywhere
    assert!(!check_resource_access(&inactive_user, AccessLevel::Guest));
    assert!(!check_resource_access(&inactive_user, AccessLevel::User));
    assert!(!check_resource_access(&inactive_user, AccessLevel::Admin));
}

use std::fs;
use std::io::{self, Write};
use std::path::Path;
use std::time::Duration;
use std::thread;

// --- VULNERABLE CODE ---
// DO NOT USE THIS IN PRODUCTION
fn create_file_insecure(path: &Path, content: &str) -> io::Result<()> {
    if path.exists() {
        // If the file exists, we decide not to create it.
        // An attacker could delete the file or replace it with a symlink to /etc/passwd here.
        eprintln!("File already exists: {:?}", path);
        return Err(io::Error::new(io::ErrorKind::AlreadyExists, "File already exists"));
    }

    // Between path.exists() and File::create(), a malicious actor could:
    // 1. Delete `path`. Then `File::create` would succeed, potentially creating a file the attacker couldn't directly make.
    // 2. Replace `path` with a symbolic link to a sensitive file (e.g., `/etc/passwd`).
    //    If our program runs with elevated privileges, `File::create` might then overwrite a critical system file.
    // This is the TOCTOU race window.
    let mut file = fs::File::create(path)?; // This syscall re-resolves the path!
    file.write_all(content.as_bytes())?;
    println!("Successfully created file: {:?}", path);
    Ok(())
}

fn main() -> io::Result<()> {
    let sensitive_path = Path::new("temp_sensitive_file.txt");
    let attacker_symlink_target = Path::new("/dev/null"); // Or a real sensitive file like /etc/passwd in a real attack

    // Clean up from previous runs
    let _ = fs::remove_file(sensitive_path);
    let _ = fs::remove_file(attacker_symlink_target); // If it's a temp target

    println!("Attempting insecure file creation...");

    // Simulate attacker activity in another thread
    let attacker_thread = thread::spawn(move || {
        // Wait a moment for the main thread to perform its `path.exists()` check
        thread::sleep(Duration::from_millis(10));
        // ATTACKER ACTION: Quickly replace the target file with a symlink
        // This relies on precise timing. In a real exploit, the attacker would try repeatedly.
        if fs::remove_file(&sensitive_path).is_ok() {
            println!("[ATTACKER] Replaced {:?} with symlink to {:?}", sensitive_path, attacker_symlink_target);
            // This is simplified. Real attacks might use `std::os::unix::fs::symlink`
            // and point to a sensitive system file if the victim process is privileged.
            // For cross-platform demo, we simulate the *outcome* of the symlink.
            // In a real scenario, `File::create` would then open the symlink's target.
            // Here, we just ensure the original file is gone.
            // A more direct demo of the vulnerability would involve a privileged context
            // and symlinking to a sensitive target like `/etc/shadow`.
        }
    });

    // Main thread (victim process) tries to create the file
    // The delay here is for demonstration purposes, making the race more likely.
    // In reality, the race window is small, requiring precise attacker timing or repeated attempts.
    thread::sleep(Duration::from_millis(5)); // Allow attacker to potentially act after `exists()` check
    let res = create_file_insecure(sensitive_path, "secret data");

    // Wait for attacker thread to finish
    let _ = attacker_thread.join();

    match res {
        Ok(_) => {
            println!("Insecure creation finished. Check {:?}", sensitive_path);
            if sensitive_path.exists() {
                // If symlinked to /dev/null, it might still "exist" but not contain our data.
                // Or if symlinked to /etc/passwd, we might have overwritten system data.
                println!("File content: {:?}", fs::read_to_string(sensitive_path));
            }
        },
        Err(e) => eprintln!("Insecure creation failed: {}", e),
    }

    // Clean up
    let _ = fs::remove_file(sensitive_path);

    // --- SECURE APPROACH (conceptual, needs careful implementation for all scenarios) ---
    // The robust solution is to use atomic file operations that don't suffer from TOCTOU.
    // For example, using `OpenOptions::new().create_new(true)` which fails if the file already exists,
    // or creating a temporary file in a secure directory and then atomically renaming it.
    // Rust's `std::fs` module provides some of these building blocks, but careful composition is key.
    println!("\nDemonstrating a conceptual secure approach (atomicity is key):");
    let secure_path = Path::new("secure_file.txt");
    let _ = fs::remove_file(secure_path); // Cleanup

    match fs::OpenOptions::new()
        .write(true)
        .create_new(true) // Fails if file exists; this is atomic.
        .open(secure_path)
    {
        Ok(mut file) => {
            file.write_all(b"secure data").expect("Failed to write secure data");
            println!("Successfully created file securely: {:?}", secure_path);
        }
        Err(e) if e.kind() == io::ErrorKind::AlreadyExists => {
            eprintln!("Secure file creation: File already exists, cannot create new. This is safe behavior.");
        }
        Err(e) => eprintln!("Secure file creation failed: {}", e),
    }
    let _ = fs::remove_file(secure_path); // Cleanup

    Ok(())
}

use std::sync::{Mutex, Arc};
use std::thread;
use std::time::Duration;

fn main() {
    println!("Demonstrating a classic deadlock scenario.");

    // Arc allows shared ownership across multiple threads.
    let resource_a = Arc::new(Mutex::new(0));
    let resource_b = Arc::new(Mutex::new(0));

    // Clone Arcs for each thread to get independent ownership pointers
    let a1 = Arc::clone(&resource_a);
    let b1 = Arc::clone(&resource_b);

    let handle1 = thread::spawn(move || {
        println!("Thread 1: Attempting to acquire Resource A...");
        let _guard_a = a1.lock().unwrap(); // Acquire A first
        println!("Thread 1: Acquired Resource A. Waiting...");
        thread::sleep(Duration::from_millis(50)); // Simulate work
        println!("Thread 1: Attempting to acquire Resource B...");
        // This thread now tries to acquire B, which Thread 2 holds.
        let _guard_b = b1.lock().unwrap(); // Deadlock!
        println!("Thread 1: Acquired Resource B.");
    });

    // Clone Arcs again for the second thread
    let a2 = Arc::clone(&resource_a);
    let b2 = Arc::clone(&resource_b);

    let handle2 = thread::spawn(move || {
        println!("Thread 2: Attempting to acquire Resource B...");
        let _guard_b = b2.lock().unwrap(); // Acquire B first
        println!("Thread 2: Acquired Resource B. Waiting...");
        thread::sleep(Duration::from_millis(50)); // Simulate work
        println!("Thread 2: Attempting to acquire Resource A...");
        // This thread now tries to acquire A, which Thread 1 holds.
        let _guard_a = a2.lock().unwrap(); // Deadlock!
        println!("Thread 2: Acquired Resource A.");
    });

    let _ = handle1.join();
    let _ = handle2.join();

    println!("Program finished. (If you see this, the deadlock was avoided or a timeout occurred. In real scenarios, it would hang.)");
    println!("If the program hangs, it's because of the deadlock.");
    println!("To reliably observe the hang, you might need to run this outside of an environment that kills hanging processes, or increase sleep durations.");

    // A real deadlock would cause the program to hang indefinitely.
    // The `_guard_a` and `_guard_b` ensure that the locks are held until the guards go out of scope,
    // which in this case, would be at the end of the closure, but they won't reach that point due to the deadlock.
}

use std::fs;
use std::os::unix::fs::PermissionsExt; // For setting unix-style permissions
use std::path::Path;
use std::io;
use std::thread;
use std::time::Duration;

// --- VULNERABLE CODE (Simplified for demonstration) ---
// DO NOT USE THIS IN PRODUCTION
fn set_secure_permissions_insecure(path: &Path, expected_owner_id: u32) -> io::Result<()> {
    // 1. Check current permissions and ownership
    let metadata = fs::metadata(path)?; // First syscall: get metadata

    // On Unix-like systems, get the owner ID
    #[cfg(unix)]
    let actual_owner_id = metadata.st_uid();
    #[cfg(not(unix))]
    let actual_owner_id = expected_owner_id; // Placeholder for non-unix

    if actual_owner_id != expected_owner_id {
        // Log a warning or error, but let's assume for this demo we proceed if it's not the owner
        // A more robust system would stop here.
        eprintln!("WARNING: File {:?} is owned by {} instead of expected {}. Proceeding with caution.",
                  path, actual_owner_id, expected_owner_id);
    }

    // 2. Set new, more restrictive permissions (e.g., owner read/write only)
    let mut permissions = metadata.permissions();
    #[cfg(unix)]
    permissions.set_mode(0o600); // rwx for owner, no access for group/others

    // This is the second syscall: set permissions
    // TOCTOU: Between step 1 and step 2, the file could have been swapped or its ownership changed.
    // If an attacker replaces `path` with a symlink to another file they own,
    // our privileged process might set permissions on *that* file, unintentionally leaking info or granting access.
    fs::set_permissions(path, permissions)?;
    println!("Successfully set secure permissions for {:?}", path);
    Ok(())
}

fn main() -> io::Result<()> {
    let target_file = Path::new("temp_privileged_file.txt");
    let initial_content = "This is sensitive data.";
    let expected_owner: u32 = 1000; // Example user ID

    // Create a dummy file for the demonstration
    fs::write(target_file, initial_content)?;
    // Attempt to simulate setting a specific owner for demonstration (this often requires root)
    // For a real demo, you'd need `chown` or similar system calls, which `std::fs` doesn't provide directly.
    // For this example, we'll assume the file *is* owned by `expected_owner` initially,
    // or that the check for `actual_owner_id` would proceed.

    println!("Attempting to set secure permissions insecurely...");

    // Simulate an attacker (or another process) manipulating the file
    let attacker_target = Path::new("attacker_controlled_file.txt");
    fs::write(attacker_target, "Attacker data").expect("Failed to create attacker file");
    let _ = fs::remove_file(target_file); // Ensure target is gone before symlink

    // Attacker thread replaces target_file with a symlink to attacker_controlled_file.txt
    let attacker_thread = thread::spawn(move || {
        thread::sleep(Duration::from_millis(10)); // Wait for main thread's metadata check
        #[cfg(unix)] {
            // Create a symlink: target_file -> attacker_controlled_file
            std::os::unix::fs::symlink(&attacker_target, &target_file)
                .expect("Attacker failed to create symlink");
            println!("[ATTACKER] Replaced {:?} with symlink to {:?}", target_file, attacker_target);
        }
        #[cfg(not(unix))] {
            // For non-unix, we'll just delete the original to simulate disruption.
            // A real non-unix exploit would use specific platform APIs.
            println!("[ATTACKER] Manipulated {:?} (simulated non-unix symlink)", target_file);
        }
    });

    let res = set_secure_permissions_insecure(target_file, expected_owner);
    let _ = attacker_thread.join();

    match res {
        Ok(_) => {
            println!("Permissions setting finished. Check files.");
            // In a real exploit, the permissions of `attacker_controlled_file.txt` might be changed
            // by the privileged process, potentially making it accessible or less secure.
            if target_file.exists() {
                println!("Content of target_file after operation: {:?}", fs::read_to_string(target_file));
            }
            if attacker_target.exists() {
                println!("Content of attacker_controlled_file after operation: {:?}", fs::read_to_string(attacker_target));
            }
        },
        Err(e) => eprintln!("Permissions setting failed: {}", e),
    }

    // Clean up
    let _ = fs::remove_file(target_file);
    let _ = fs::remove_file(attacker_target);

    Ok(())
}