4 ms·

After reviewing my own code. Thanks for digging into the code! You're reviewing the regex fallback patterns that only trigger when AST parsing fails. The primar

After reviewing my own code. Thanks for digging into the code! You're reviewing the regex fallback patterns that only trigger when AST parsing fails. The primary detection uses Tree-sitter for structural analysis and taint flow tracking. That TOCTOU pattern IS terrible - it's meant as a last-resort 'something might be wrong here' flag when we can't parse the AST. The real detection happens in theauditor/taint_analyzer/ which tracks actual data flow from filesystem checks to file operations. But you're right - even fallback patterns shouldn't be this noisy. I'll tighten it to only flag actual filesystem operations: - os.path.exists → open() - fs.exists → fs.writeFile() - File.exists() → new FileWriter() If you actually run the tool with aud full, it uses the proper AST analysis first. These regex patterns are the third fallback when Tree-sitter isn't available. Thanks for the specific feedback - this is exactly why I open-sourced it!

deleted 1y ago
[deleted]
drsopp 1y ago
How come AST parsing fails? Does that imply syntax errors in the code?
- ThailandJohn 1y ago
  AST parsing fails primarily due to installation issues, not syntax errors in your code. TheAuditor uses a sandboxed environment (.auditor_venv/) to avoid polluting your system. When Tree-sitter isn't properly installed in that sandbox, we fall back to regex patterns. Common causes: 1. Missing C compiler - Tree-sitter needs to compile language grammars 2. Incomplete setup - User didn't run aud setup-claude --target . which installs the AST tools 3. Old installation - Before we fixed the [ast] dependency inclusion If your code had syntax errors, you'd get different errors entirely (and your code probably wouldn't run). The "AST parsing fails" message specifically means Tree-sitter isn't available, so we're using the fallback regex patterns instead. Just pushed clearer docs about this today actually. Run aud setup-claude --target . in your project and Tree-sitter should work properly.
  - deleted 1y ago
    [deleted]

deleted 1y ago

[deleted]

drsopp 1y ago

How come AST parsing fails? Does that imply syntax errors in the code?

ThailandJohn 1y ago
AST parsing fails primarily due to installation issues, not syntax errors in your code. TheAuditor uses a sandboxed environment (.auditor_venv/) to avoid polluting your system. When Tree-sitter isn't properly installed in that sandbox, we fall back to regex patterns. Common causes: 1. Missing C compiler - Tree-sitter needs to compile language grammars 2. Incomplete setup - User didn't run aud setup-claude --target . which installs the AST tools 3. Old installation - Before we fixed the [ast] dependency inclusion If your code had syntax errors, you'd get different errors entirely (and your code probably wouldn't run). The "AST parsing fails" message specifically means Tree-sitter isn't available, so we're using the fallback regex patterns instead. Just pushed clearer docs about this today actually. Run aud setup-claude --target . in your project and Tree-sitter should work properly.
- deleted 1y ago
  [deleted]