一句话：在生态系统规模上实证研究 ReDoS 的实际影响，揭示超线性正则表达式的分布与危害。
正则表达式广泛用于文本处理，但其超线性最坏情况复杂度可被攻击者触发，导致 CPU 资源耗尽和拒绝服务（ReDoS）。已有研究提出了检测超线性正则的方法，实践者也总结了一些可能导致此类复杂度的反模式启发式，但 ReDoS 在真实软件生态中的实际影响仍缺乏系统性认识。本文在生态系统尺度上对 ReDoS 进行实证研究，考察真实项目中正则表达式的使用、超线性风险的分布及其潜在危害，并联系已有检测技术与启发式规则，评估这些风险在实践中的表现。该工作为理解 ReDoS 的现实威胁、改进检测与防御提供了大规模经验证据。
Regular expressions (regexes) are a popular and powerful means of automatically manipulating text. Regexes are also an understudied denial of service vector (ReDoS). If a regex has super-linear worst-case complexity, an attacker may be able to trigger this complexity, exhausting the victim’s CPU resources and causing denial of service. Existing research has shown how to detect these superlinear regexes, and practitioners have identified super-linear regex anti-pattern heuristics that may lead to such complexity.
@inproceedings{paperbot4690,
title = {The impact of regular expression denial of service (ReDoS) in practice: an empirical study at the ecosystem scale},
author = {James C. Davis and Christy A. Coghlan and Francisco Servant and Dongyoon Lee},
booktitle = {FSE},
year = {2018},
doi = {10.1145/3236024.3236027}
}