为什么正则表达式不是通用语言？正则表达式的可重用性和可移植性实证研究
Why Aren't Regular Expressions a Lingua Franca? An Empirical Study on the Re-use and Portability of Regular Expressions
摘要：
本文探讨了正则表达式（regex）跨程序设计语言的可移植性。许多语言都提供类似的正则表达式语法，因此很自然地认为正则表达式可以跨语言边界移植。但是，正则表达式是否可以跨语言边界复制/粘贴，同时保留其语义和性能特征？在我们对158名专业软件开发人员的调查中，大多数人表示他们跨语言边界重用regex，大约一半的人报告说他们认为regex是一种通用语言。我们使用一个新的正则表达式语料库对这种做法的风险进行了实验性评估--来自193，524个项目的537，806个正则表达式，这些项目使用JavaScript、Java、PHP、Python、Ruby、Go、Perl和Rust编写。使用我们的polyglot正则表达式语料库，我们探讨了迄今尚未研究的正则表达式可移植性问题：由于语义差异的逻辑错误，由于性能差异的安全漏洞。我们报告说，开发人员对regex lingua franca的信念是可以理解的，但没有根据。虽然大多数正则表达式跨语言边界编译，但15%的正则表达式表现出跨语言的语义差异，10%的正则表达式表现出跨语言的性能差异。我们使用regex文档解释了这些差异，并通过调查regex引擎实现进一步阐明了我们的发现。在此过程中，我们发现了JavaScript-V8、Python、Ruby和Rust的正则表达式引擎中的错误，以及数千个模块中潜在的语义和性能正则表达式错误。
英文摘要：
This paper explores the extent to which regular expressions (regexes) are portable across programming languages. Many languages offer similar regex syntaxes, and it would be natural to assume that regexes can be ported across language boundaries. But can regexes be copy/pasted across language boundaries while retaining their semantic and performance characteristics? In our survey of 158 professional software developers, most indicated that they re-use regexes across language boundaries and about half reported that they believe regexes are a universal language. We experimentally evaluated the riskiness of this practice using a novel regex corpus -- 537,806 regexes from 193,524 projects written in JavaScript, Java, PHP, Python, Ruby, Go, Perl, and Rust. Using our polyglot regex corpus, we explored the hitherto-unstudied regex portability problems: logic errors due to semantic differences, and security vulnerabilities due to performance differences. We report that developers' belief in a regex lingua franca is understandable but unfounded. Though most regexes compile across language boundaries, 15% exhibit semantic differences across languages and 10% exhibit performance differences across languages. We explained these differences using regex documentation, and further illuminate our findings by investigating regex engine implementations. Along the way we found bugs in the regex engines of JavaScript-V8, Python, Ruby, and Rust, and potential semantic and performance regex bugs in thousands of modules.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
