Why Arent Regular Expressions a Lingua Franca James

Why Aren’t Regular Expressions a Lingua Franca? James Davis Mischa Michael Francisco Servant Christy Coghlan Dongyoon Lee -1 -

Summary of Contributions 1. Developer perspectives Survey of 158 devs 2. Regex re-use Corpus of 500 K regexes 3. Portability experiments Language -2 -

Background -3 -

What are regexes used for? • 30 -40% of Python and Java. Script projects • Diverse purposes File names Tokens Email Command-line tools Lexers Input validation -4 -

The regex development process 583 K views 1. 23 ^d+(. d{1, 2})? $ n 1. 23 -5 -

Research -6 -

Research questions Developer perspectives Do developers re-use regexes? Where do developers re-use regexes from? Do developers believe regexes are a lingua franca? Measuring regex re-use How commonly are regexes re-used? (other software ; Internet) Empirical portability Different regex semantics? Different regex performance? -7 -

Developer perspectives Developers’ Regex Re-use Practices -8 -

Survey methodology and respondents 33 questions, closed / open-ended. IRB. • Regex process, re-use practices, and portability Median developer -9 -

Respondents re-use regexes across languages 94% of developers re-use regexes When re-using, developers are rarely confident that the regex comes from the same programming language - 10 -

Measuring Regex Re-Use Polyglot Regex Corpus - 11 -

Regex collection methodology Module regex extraction Module selection Unique regexes Top 25 K - 12 -

Regex corpus Num. modules 25 K Unique regexes 150 K ” 20 K ” 45 K ” 150 K ” All (30 K) All (10 K) 20 K 140 K 2 K 193 K modules 580 K unique regexes - 13 -

“Complex” regex re-use by module - 14 -

(Empirical) Portability Semantic + Performance Differences - 15 -

What-if experiments using regex testers match regex against input if match: emit matched substring emit capture groups else: report “no match” /(d+). d+/ & 3. 14 Match substring “ 3. 14” capture “ 3” - 16 -

Semantics: Methodology Rex, Mut. Rex, EGRET, Re. Scue, BRICS Input generators Both match? Same substring? Same captures? Regex testers Language semantic analysis (pairwise) - 17 -

Copy/pasting regexes leads to semantic differences 8% had a match witness 4% had a substring witness 7% had a capture witness In total, 15% of regexes (82 K) had a difference witness - 18 -

Some sample results of semantic differences Witness Language 1 Behavior 2 2 c. C ctrl-C “c. C” ^a Begin input Begin line a++ Possessive quantifier Quantifier “]” Empty capture group []] Undocumented behaviors - 19 -

Performance methodology SL regex detectors Per-lang. complexity 1200 1000 800 600 400 200 0 0 10 20 30 40 - 20 -

Performance results - 21 -

Summarized in developer-friendly heatmaps - 22 -

Closing Remarks - 23 -

Regexes are not a lingua franca Survey: developers say they believe and act like they are Empirical re-use study: regexes are re-used Portability experiments: Correctness, security concerns Thank you for your attention - 24 -

Bonus material - 25 -

False negatives in the SL regex detectors • The SL regex detectors are using full. Match semantics • Regex engines sometimes implement • partial. Match…unwisely Thus, and somewhat horrifyingly: • /(a+)b/ may be super-linear • Equivalent to the full. Match /^. *? (a+)b/ QOA - 26 -

Why not applications? • Open-source applications may not be representative of code in industry • Module ecosystems are shared by open-source and industry • Modules are sometimes authored by industry as a way to give back to the open-source community - 27 -

Why git projects instead of artifacts? Bundling / Obfuscation complicates analysis on registry artifacts - 28 -

Cut-off point for “popular modules” First 25, 000 modules JS: ~60 stars Others: <10 Rust: 13 K modules - 29 -

Registries and Languages - 30 -

Why modules, not applications? Modules are comparable building blocks • • Strings Math Command-line scripting aids Graphics We think modules are more comparable across languages than applications would be. - 31 -

Getting modules from a registry API: “All module metadata” Filter for github. com URLs 465, 030 modules API: “Modules by first letter” API: Per-module info Filter for github. com URLs 100, 954 modules - 32 -

Unique regexes per module - 33 -

Regex re-use practices - 34 -

Regex portability beliefs - 35 -

Language versions used in experiments - 36 -

Input generation results - 37 -

Analyzing Regexes 60 K 350 K 2. Degree 1. Re. Do. S regexes 1200 [R&T ‘ 14] [WMBW ‘ 16] [WOHD ‘ 17] 1000 800 600 400 704 (1%) 3. 6 K (1%) 200 0 0 13 K (3%) 705 (1%) 5 10 15 20 25 30 35 - 39 -

Regex re-use in modules (“Complex” regexes) Every language has complex regexes Systems languages that Regexes are rareappear in other languages JS: Highest re-use rates Duplication is rare - 40 -

Regex collection methodology Module regex extraction Module selection HEAD • static analysis Unique regexes Top 25 K - 41 -

Comparing specifications (in the form of language documentation) was a starting point, of course. But regex engines are complex and under-specified, so there’s no substitute for actually evaluating regexes in different languages and comparing how they behave. - 42 -

As it turns out, both engines have defense mechanisms to avoid long-running regex evaluations. They both use a counter-based scheme to short-circuit longrunning evaluations with an exception. In addition, Perl maintains a limited backtracking cache to avoid some redundant searches. As you can see, neither defense mechanism is complete; there is still polynomial and exponential behavior to be found there. But these mechanisms may be a good idea for other regex engine maintainers to consider. - 43 -

(Some) Limitations and Future Work xxx - 44 -

Some regex examples /^a+$/ /d{1, 3}. d{1, 3}/ /^[a-z. A-Z 0 -9]+([. _]? [a-z. A-Z 0 -9]+)*$/ Some ‘a’ IPv 4 Usern - 45 -

What are regexes used for? • 30 -40% of Python and Java. Script projects • Diverse purposes User-agent string Server-side rendering Source code Linters File names Command-line tools Tokens Lexers HTML Browser plug-ins - 46 -