一句话：通过对多语言正则语料库的实证分析，揭示正则表达式跨语言复用存在语义与性能差异及安全风险。
论文研究正则表达式能否作为跨编程语言的通用表示被直接复用。作者先调查158名专业开发者，发现多数人跨语言复用正则，约半数认为其通用。随后构建包含8种语言、193,524个项目、537,806条正则的多语言语料库，实验比较同一正则在不同语言中的编译、语义与性能表现，并结合文档和引擎实现解释差异。结果显示，尽管多数正则可跨语言编译，15%存在语义差异，10%存在性能差异，后者可能带来安全漏洞；还发现JavaScript-V8、Python、Ruby、Rust等正则引擎的缺陷以及数千模块中的潜在问题。
This paper explores the extent to which regular expressions (regexes) are portable across programming languages. Many languages offer similar regex syntaxes, and it would be natural to assume that regexes can be ported across language boundaries. But can regexes be copy/pasted across language boundaries while retaining their semantic and performance characteristics? In our survey of 158 professional software developers, most indicated that they re-use regexes across language boundaries and about half reported that they believe regexes are a universal language.We experimentally evaluated the riskiness of this practice using a novel regex corpus — 537,806 regexes from 193,524 projects written in JavaScript, Java, PHP, Python, Ruby, Go, Perl, and Rust. Using our polyglot regex corpus, we explored the hitherto-unstudied regex portability problems: logic errors due to semantic differences, and security vulnerabilities due to performance differences. We report that developers’ belief in a regex lingua franca is understandable but unfounded. Though most regexes compile across language boundaries, 15% exhibit semantic differences across languages and 10% exhibit performance differences across languages. We explained these differences using regex documentation, and further illuminate our findings by investigating regex engine implementations. Along the way we found bugs in the regex engines of JavaScript-V8, Python, Ruby, and Rust, and potential semantic and performance regex bugs in thousands of modules.
@inproceedings{paperbot5101,
title = {Why aren’t regular expressions a lingua franca? an empirical study on the re-use and portability of regular expressions},
author = {James C. Davis and Louis G. Michael IV and Christy A. Coghlan and Francisco Servant and Dongyoon Lee},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3338909}
}