Why aren’t regular expressions a lingua franca? an empirical study on the re-use and portability of regular expressions
Why aren’t regular expressions a lingua franca? an empirical study on the re-use and portability of regular expressions
复制标题
DOI：
10.1145/3338906.3338909
复制
发表时间：
2019-08
期刊：
影响因子：
--
通讯作者：
James C. Davis;IV LouisG.Michael;Christy A. Coghlan;Francisco Servant;Dongyoon Lee
中科院分区：
文献类型：
--
作者：
James C. Davis;IV LouisG.Michael;Christy A. Coghlan;Francisco Servant;Dongyoon Lee
本文探讨了跨编程语言的正则表达式（REGEXES）提供了类似的语法，并且自然而然地假设Regexes可以在语言边界上进行跨语言范围。 boundaries and about half reported that they believe regex are a universal language.We experimentally evaluated the riskiness of this practice using a novel regex corpus — 537,806 regex corpus from 193,524 projects written in JavaScript, Java, PHP, Python, Ruby, Go, Perl, and Rust. Using our polyglot regex corpus, we explored the hitherto-unstudied regex portability problems: logic errors due to semantic differences, and security由于绩效的差异，我们报告说，开发人员对言语的语言是可以理解的，但大多数是在语言边界上编译的。 JavaScript-V8，Python，Ruby和Rust的Regex引擎以及数千个模块中的潜在语义和性能正则虫子。
This paper explores the extent to which regular expressions (regexes) are portable across programming languages. Many languages offer similar regex syntaxes, and it would be natural to assume that regexes can be ported across language boundaries. But can regexes be copy/pasted across language boundaries while retaining their semantic and performance characteristics? In our survey of 158 professional software developers, most indicated that they re-use regexes across language boundaries and about half reported that they believe regexes are a universal language.We experimentally evaluated the riskiness of this practice using a novel regex corpus — 537,806 regexes from 193,524 projects written in JavaScript, Java, PHP, Python, Ruby, Go, Perl, and Rust. Using our polyglot regex corpus, we explored the hitherto-unstudied regex portability problems: logic errors due to semantic differences, and security vulnerabilities due to performance differences. We report that developers’ belief in a regex lingua franca is understandable but unfounded. Though most regexes compile across language boundaries, 15% exhibit semantic differences across languages and 10% exhibit performance differences across languages. We explained these differences using regex documentation, and further illuminate our findings by investigating regex engine implementations. Along the way we found bugs in the regex engines of JavaScript-V8, Python, Ruby, and Rust, and potential semantic and performance regex bugs in thousands of modules.