2021/05/10 by James C. Davis, Davis, James C., Louis G. Michael +7 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #FOS: Computer and information sciences #Programming Languages (cs.PL) #Software Engineering (cs.SE) #Software Engineering Research #Software Testing and Debugging Techniques #Web Application Security Vulnerabilities
paper · pdf · doi:10.48550/arxiv.2105.04397
openalex publication_date 2021/05/10 · openalex created_date 2022/07/25 · openalex updated_date 2026/07/28
This paper explores the extent to which regular expressions (regexes) are\nportable across programming languages. Many languages offer similar regex\nsyntaxes, and it would be natural to assume that regexes can be ported across\nlanguage boundaries. But can regexes be copy/pasted across language boundaries\nwhile retaining their semantic and performance characteristics?\n In our survey of 158 professional software developers, most indicated that\nthey re-use regexes across language boundaries and about half reported that\nthey believe regexes are a universal language. We experimentally evaluated the\nriskiness of this practice using a novel regex corpus -- 537,806 regexes from\n193,524 projects written in JavaScript, Java, PHP, Python, Ruby, Go, Perl, and\nRust. Using our polyglot regex corpus, we explored the hitherto-unstudied regex\nportability problems: logic errors due to semantic differences, and security\nvulnerabilities due to performance differences.\n We report that developers' belief in a regex lingua franca is understandable\nbut unfounded. Though most regexes compile across language boundaries, 15%\nexhibit semantic differences across languages and 10% exhibit performance\ndifferences across languages. We explained these differences using regex\ndocumentation, and further illuminate our findings by investigating regex\nengine implementations. Along the way we found bugs in the regex engines of\nJavaScript-V8, Python, Ruby, and Rust, and potential semantic and performance\nregex bugs in thousands of modules.\n