正则表达式很难：正则表达式编程中的决策、困难和风险
Regexes are Hard: Decision-making, Difficulties, and Risks in Programming Regular Expressions
摘要：
正则表达式（regex）是解决字符串匹配问题的强大机制。它们被所有现代程序设计语言支持，并且估计出现在超过三分之一的Python和JavaScript项目中。然而，现有的研究主要集中在正则表达式编程的一个方面：可读性。我们对开发人员如何理解和编程正则表达式知之甚少，也不知道他们面临的困难。在本文中，我们提供了正则表达式开发周期的第一个研究，重点是（1）开发人员如何在整个过程中做出决策，（2）他们面临的困难，以及（3）他们如何意识到编程正则表达式所涉及的严重风险。我们采取了混合方法，调查了279名来自不同背景（包括顶级科技公司）的专业开发人员，以获得高层次的视角，并采访了17名开发人员，以了解他们面临的困难和他们更喜欢的解决方案的细节。简而言之，正则表达式很难。它们不仅难以阅读，我们的参与者说，它们很难搜索，很难验证，也很难记录。它们也很难掌握：我们研究的大多数开发人员都没有意识到使用正则表达式时可能发生的关键安全风险，而那些知道风险的人也没有以有效的方式处理它们。我们的研究结果为未来的工作，包括语义正则表达式搜索引擎正则表达式重用和改进的输入生成器正则表达式验证提供了多种影响。
英文摘要：
Regular expressions (regexes) are a powerful mechanism for solving string-matching problems. They are supported by all modern programming languages, and have been estimated to appear in more than a third of Python and JavaScript projects. Yet existing studies have focused mostly on one aspect of regex programming: readability. We know little about how developers perceive and program regexes, nor the difficulties that they face. In this paper, we provide the first study of the regex development cycle, with a focus on (1) how developers make decisions throughout the process, (2) what difficulties they face, and (3) how aware they are about serious risks involved in programming regexes. We took a mixed-methods approach, surveying 279 professional developers from a diversity of backgrounds (including top tech firms) for a high-level perspective, and interviewing 17 developers to learn the details about the difficulties that they face and the solutions that they prefer. In brief, regexes are hard. Not only are they hard to read, our participants said that they are hard to search for, hard to validate, and hard to document. They are also hard to master: the majority of our studied developers were unaware of critical security risks that can occur when using regexes, and those who knew of the risks did not deal with them in effective manners. Our findings provide multiple implications for future work, including semantic regex search engines for regex reuse and improved input generators for regex validation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
