Static Analysis Possibilities for Regular Expressions in C++
TL;DR
This research measured 26 different popular open-source projects and found that in more than two-thirds of the time, constructors used hardcoded parameters, which opens the possibility for the creation of an effective static analysis tool.
Abstract
Most of the regular expression libraries in current programming languages utilize a dynamic constructor parameter to construct a state machine, which will be used later in the matching. When this constructor parameter does not fulfill the requirements of the correct regular expression syntax, a runtime error – usually an exception – occurs. It would be highly beneficial if we could catch this kind of problem at compile time with the help of static analysis. The prerequisite of such an analysis is that the constructor parameter is fully known at compile time. In this research, we investigate the extent to which this prerequisite holds true for open-source software projects. We measured 26 different popular open-source projects, and we found that in more than two-thirds of the time, constructors used hardcoded parameters. This result opens the possibility for the creation of an effective static analysis tool.