Each KAST expression starts with a double slash (//) followed by a sequence of steps separated by slash symbols. Each step specifies a subpattern to be applied to specific AST nodes.

You can use '*' instead of any type name.

When a checker is matched, the message is reported on the node that was matched with the last node in the described sequence.

For example:

//IfStat

This KAST expression contains one step, IfStat, that matches any AST node of type IfStat. The full KAST expression can be read as "find all if statements (without an else block)".

//IfStat/ThenStat::ExprStat

The above KAST expression breaks down into two steps, IfStat and ThenStat::ExprStat. The second step specifies a child name (ThenStat) and a type of child node (ExprStat). The KAST expression above can be read as "find all 'if' statements that have an expression statement as their 'then' branch and that do not have an 'else' branch". Note that 'if-else' statements correspond to a different AST type, IfElseStat.

When a KAST expression contains more than one step, every subsequent step must specify a child name. Specifying the child name is required because a single AST node may have multiple children of the same type. An example of this is an 'if-else' statement in which both branches are compound statements. Consequently, the type of child node cannot be used to uniquely identify the path to follow. Child names are unique and unambiguously specify the direction of traversal.

To represent an absent separate or list child, use the 'Null' keyword:

//ReturnStat/Expr::Null

There are two steps in this KAST expression: ReturnStat and Expr::Null. It can be read as "find all return statements without an expression".

Conditions

A step in a KAST expression can be more complex that just a restriction on the type of a node. The name of the type can be followed by a sequence of predicates, which are conditions to be checked against the current AST node. A condition is enclosed in square brackets and can be either a boolean expression or a KAST subexpression:

//ExprBinary[@Op=OP_PLUS]

This KAST expression is read as "find all binary expressions whose operation is +".

The only step of this expression specifies:

the expected type of node (BinaryExpr)
a condition ([@Op=OP_PLUS]).

The "at" symbol (@) is used to refer to the current node's attribute.

//ExprCall/Expr::ExprName[Name::Name[@Name='nice_method']]

This expression has four steps to "find all calls to method 'nice_method'". The second step includes a nested KAST expression, with an additional step as a condition.