Bugs Rust's Type System Won't Catch

Rust prevents memory unsafety and data races, not logic bugs that live in syscalls, encoding, error propagation, or trust boundaries. These are the recurring classes.

Filesystem race & identity bugs

OsStr / bytes vs String

Filesystem paths and process args are not guaranteed UTF-8 on Unix.

• String::from_utf8_lossy corrupts binary streams by replacing bytes with U+FFFD.
• print!("{}", ...) panics on broken pipe and forces UTF-8.
• Stay in bytes: OsStr, OsString, Path, PathBuf, Vec<u8>, &[u8]. Use io::stdout().write_all(&bytes) for raw output.

Panic-on-input is a DoS

unwrap(), expect(), and indexing can panic when input violates their preconditions. Integer +/- overflow can panic with checks enabled or wrap with checks disabled; never rely on build-profile behavior to reject invalid input. For input-facing crates, configure optional Clippy restrictions in Cargo.toml:

# Cargo.toml (not clippy.toml)
[lints.clippy]
unwrap_used = "warn"
expect_used = "warn"
panic = "warn"
indexing_slicing = "warn"
arithmetic_side_effects = "warn"

Use ?, .get(i), checked_add, try_from for expected failures. A justified expect may document an internal invariant whose violation is a bug; explain why input cannot invalidate it. Gallant's panic-boundary discussion distinguishes those bugs from recoverable input errors. Rust's overflow rules remain configuration-sensitive.

Silently discarded errors

file.set_len(size).ok();          // hides ENOSPC
let _ = writeln!(out, "...");     // hides broken pipe
fs::remove_file(p).unwrap_or_default();

Propagate. If ignoring is intentional, leave a comment naming the exact errno that's safe. In tools that iterate (e.g. rm -r), track the worst exit code and return it at the end rather than aborting on first failure or losing failures silently.

Trust boundaries: chroot, setuid, sandboxing

NSS (getpwnam, getgrnam, DNS) and other glibc paths dlopen shared libs at call time. After chroot, those loads come from the new root.

let uid = users::get_user_by_name(name);  // resolve BEFORE
chroot(new_root)?;                         // ...then cross the boundary

Static linking the Rust binary does not prevent glibc from dlopen'ing NSS modules. Resolve users, groups, hostnames, and load any plugins before chroot/setuid/seccomp.

Reimplementing GNU/BSD tools

When rewriting coreutils, find, grep, etc., scripts depend on bug-for-bug behavior: exit codes, stderr wording, signal-name parsing (kill -1 vs kill -SIGHUP), locale-sensitive sort, glob edge cases. Run the upstream test suite in CI; treat behavioral divergence as a bug, not a feature.

Pitfalls

• create_new(true) returns AlreadyExists on dangling symlinks — handle it; don't fall back to create() which re-introduces the race.
• canonicalize requires the path to exist; for not-yet-created files, canonicalize the parent and join the basename.
• OsStr has no len_chars or contains(&str) — converting to &str to search reintroduces the UTF-8 assumption you were avoiding.
• Clippy arithmetic_side_effects flags every + including loop counters; scope it to crates handling untrusted input, not workspace-wide.
• chroot alone is not a sandbox; combine with setuid to a non-root user and ideally seccomp/landlock.