Regexes are Hard: Decision-Making, Difficulties, and Risks in Programming Regular Expressions

Abstract

Regular expressions (regexes) are a powerful mechanism for solving string-matching problems. They are supported by all modern programming languages, and have been estimated to appear in more than a third of Python and JavaScript projects. Yet existing studies have focused mostly on one aspect of regex programming: readability. We know little about how developers perceive and program regexes, nor the difficulties that they face.In this paper, we provide the first study of the regex development cycle, with a focus on (1) how developers make decisions throughout the process, ( 2) what difficulties they face, and (3) how aware they are about serious risks involved in programming regexes. We took a mixed-methods approach, surveying 279 professional developers from a diversity of backgrounds (including top tech firms) for a high-level perspective, and interviewing 17 developers to learn the details about the difficulties that they face and the solutions that they prefer.In brief, regexes are hard. Not only are they hard to read, our participants said that they are hard to search for, hard to validate, and hard to document. They are also hard to master: the majority of our studied developers were unaware of critical security risks that can occur when using regexes, and those who knew of the risks did not deal with them in effective manners. Our findings provide multiple implications for future work, including semantic regex search engines for regex reuse and improved input generators for regex validation.

Demystifying Regular Expression Bugs: A comprehensive study on regular expression bug causes, fixes, and testing

“…Rejecting valid strings represents 61.8% of the incorrect behavior bugs. This reinforces the observation that developers prefer to compose a conservative regex to an overly liberal one [39] and tend to expand the scope of regular expressions as software evolves [62].…”

“…(mozilla/fxa-auth-server#1743). This problem is regarded to be one of the difficulties of regex programming [39]. Further research efforts are needed to better understand when to use and when not to use regexes.…”

“…Prior work has surveyed developers to identify pain points associated with regular expression usage [5,39]. Rather than surveying developers, this work explored the discussions in regex-related PRs.…”

Automating Cyber Threat Hunting Using NLP, Automated Query Generation, and Genetic Perturbation

“…In the future, we plan to identify variations of CALDERA commands to further identify threats. Finally, we are considering the value of the GPE adding perturbations that are like regular expressions [12], directing the hunt to a family of variants to which a threat may evolve.…”

An Intermediate Representation-based Approach for Query Translation using a Syntax-Directed Method

“…The most obvious limitation is the lack of recursion. Statements can quickly turn out messy and hard to maintain [6] [7]. Thus, regular expressions are not quite enough.…”