After reviewing my own code.
Thanks for digging into the code! You're reviewing the regex fallback patterns that only trigger when AST
parsing fails. The primary detection uses Tree-sitter for structural analysis and taint flow tracking.
That TOCTOU pattern IS terrible - it's meant as a last-resort 'something might be wrong here' flag when we
can't parse the AST. The real detection happens in theauditor/taint_analyzer/ which tracks actual data flow
from filesystem checks to file operations.
But you're right - even fallback patterns shouldn't be this noisy. I'll tighten it to only flag actual
filesystem operations:
- os.path.exists → open()
- fs.exists → fs.writeFile()
- File.exists() → new FileWriter()
If you actually run the tool with aud full, it uses the proper AST analysis first. These regex patterns are
the third fallback when Tree-sitter isn't available.
Thanks for the specific feedback - this is exactly why I open-sourced it!
AST parsing fails primarily due to installation issues, not syntax errors in your code.
TheAuditor uses a sandboxed environment (.auditor_venv/) to avoid polluting your system. When Tree-sitter
isn't properly installed in that sandbox, we fall back to regex patterns. Common causes:
1. Missing C compiler - Tree-sitter needs to compile language grammars
2. Incomplete setup - User didn't run aud setup-claude --target . which installs the AST tools
3. Old installation - Before we fixed the [ast] dependency inclusion
If your code had syntax errors, you'd get different errors entirely (and your code probably wouldn't run). The
"AST parsing fails" message specifically means Tree-sitter isn't available, so we're using the fallback regex patterns instead.
Just pushed clearer docs about this today actually. Run aud setup-claude --target . in your project and
Tree-sitter should work properly.
That TOCTOU pattern IS terrible - it's meant as a last-resort 'something might be wrong here' flag when we can't parse the AST. The real detection happens in theauditor/taint_analyzer/ which tracks actual data flow from filesystem checks to file operations.
But you're right - even fallback patterns shouldn't be this noisy. I'll tighten it to only flag actual filesystem operations: - os.path.exists → open() - fs.exists → fs.writeFile() - File.exists() → new FileWriter()