Fixed a regular expression denial of service issue by limiting whites…

[prodigysml]

…paces

Change Summary

As discussed over email, this fixes a security issue where a regular expression denial of service can be performed.

Exploit code is below:

import time
from pydantic import networks
from pydantic.networks import validate_email

start = time.time()

try:
    exploit_string = '<' + ' ' * 3000
    validate_email(exploit_string)
except:
    pass

print(f"Time elapsed: {time.time() - start}")

Related issue number

NA

Checklist

• The pull request title is a good summary of the changes - it will be used in the changelog
• Unit tests for the changes exist
• Tests pass on CI
• Documentation reflects the changes where applicable
• [ x My PR is ready to review, please add a comment including the phrase "please review" to assign reviewers

Selected Reviewer: @samuelcolvin

[prodigysml]

please review

[prodigysml]

Seems like I've broken something. I'll see if I can fix it

[samuelcolvin]

Please add a test showing that more than 5 spaces is invalid with a comment as to why.

Otherwise LGTM.

[hramezani]

please update

[adriangb]

won't other filler characters still cause the same issue? IMO it'd be better to just set a reasonable length limit like 2048 characters.

[samuelcolvin]

Lgtm

[prodigysml]

Awesome! @samuelcolvin can we open up a security advisor for this one?

[Quietus]

This has changed the intent of the regex - previously it only matched one or more characters, now it matches 0 characters. Admittedly the previous regex would match a space alone if the address was < > and this will not, but it is a change beyond the statement in the pull request.

[samuelcolvin]

Note for anyone coming to this in future, in #7599 (before releasing this PR) we reverted this change so the only actual change implemented is the length check which covers the original minor performance risk.

[allanlewis]

Will this change be backported to v1?

[samuelcolvin]

yes we should, @hramezani please could you back port this to V1 and get a release out?

[allanlewis]

Am I right that this fix is included in v1.10.13?

[hramezani]

@allanlewis Yes. it is.

[allanlewis]

Excellent - thanks for arranging the backport in record time!

[prodigysml]

@samuelcolvin would it be possible to open up a security advisory for this one?

[samuelcolvin]

I really don't think it's necessary.