From 7eae86a7e5cdd728998bf54e30fdd27c7198a945 Mon Sep 17 00:00:00 2001
From: neha khan <neha@research.digiscrypt.com>
Date: Fri, 6 Nov 2026 14:02:08 +0530
Subject: [PATCH] Avoid quadratic backtracking in email and idn-email format
 regexes

Both regexes run on the validated data and backtrack quadratically on
long invalid strings. After the @, [^@]+\.[^@]+\Z retries every dot
when the string ends in a second @, and the email lookahead
(?!.*\.\..*@) rescans the rest of the string for each '..'. Rejecting
'a@' + 'a.' * 40000 + '@' (80 KB) took 24 s for email, and
'a@a' + '.' * 80000 + '@' took 61 s for idn-email.

Match the local part as dot-separated runs of [^@.] and check for a dot
inside the domain with a single lookahead, so both regexes run in linear
time. idn-email accepts the same strings as before. email now also
rejects '..' in the local part when a newline sits between it and the
@, which the old lookahead's '.' could not see.
---
 CHANGELOG.txt             |  1 +
 fastjsonschema/draft04.py |  2 +-
 fastjsonschema/draft07.py |  2 +-
 tests/test_format.py      | 55 ++++++++++++++++++++++++++++++++++++++-
 4 files changed, 57 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index dd8f8fd..95b7b5b 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -1,6 +1,7 @@
 === UNRELEASED
 
 * Fixed `$` in `patternProperties` matching before a trailing newline, which also made a `pattern` with the same regex accept a trailing newline
+* Fixed quadratic backtracking in the `email` and `idn-email` format regexes on long invalid strings
 
 === 2.22.3 (2026-11-01)
 
diff --git a/fastjsonschema/draft04.py b/fastjsonschema/draft04.py
index cba1e48..aa4e1f3 100644
--- a/fastjsonschema/draft04.py
+++ b/fastjsonschema/draft04.py
@@ -34,7 +34,7 @@ class CodeGeneratorDraft04(CodeGenerator):
     # library. Some regexps are not 100% precise but good enough, fast and without dependencies.
     FORMAT_REGEXS = {
         'date-time': r'^(?:' + DATE_REGEX + r')(t|T)(?:[01]\d|2[0-3]):[0-5]\d:(?:[0-5]\d|60)(?:\.\d+)?(?:[+-](?:[01]\d|2[0-3]):[0-5]\d|[+-](?:[01]\d|2[0-3])[0-5]\d|z|Z)\Z',
-        'email': r'^(?!.*\.\..*@)[^@.][^@]*(?<!\.)@[^@]+\.[^@]+\Z',
+        'email': r'^[^@.]+(?:\.[^@.]+)*@(?=[^@][^@.]*\.[^@])[^@]+\Z',
         'hostname': r'^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]{0,61}[A-Za-z0-9])\Z',
         'ipv4': r'^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\Z',
         'ipv6': r'^(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,1}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\Z',
diff --git a/fastjsonschema/draft07.py b/fastjsonschema/draft07.py
index 86476e7..42bba29 100644
--- a/fastjsonschema/draft07.py
+++ b/fastjsonschema/draft07.py
@@ -8,7 +8,7 @@ class CodeGeneratorDraft07(CodeGeneratorDraft06):
         'date': r'^(?:' + DATE_REGEX + r')\Z',
         'iri': r'^\w+:(\/?\/?)[^\s]+\Z',
         'iri-reference': r'^(\w+:(\/?\/?))?[^#\\\s]*(#[^\\\s]*)?\Z',
-        'idn-email': r'^[^@]+@[^@]+\.[^@]+\Z',
+        'idn-email': r'^[^@]+@(?=[^@][^@.]*\.[^@])[^@]+\Z',
         # pylint: disable=line-too-long
         'idn-hostname': r'^(?!-)(xn--)?[a-zA-Z0-9][a-zA-Z0-9-_]{0,61}[a-zA-Z0-9]{0,1}\.(?!-)(xn--)?([a-zA-Z0-9\-]{1,50}|[a-zA-Z0-9-]{1,30}\.[a-zA-Z]{2,})$',
         'relative-json-pointer': r'^(?:0|[1-9][0-9]*)(?:#|(?:\/(?:[^~/]|~0|~1)*)*)\Z',
diff --git a/tests/test_format.py b/tests/test_format.py
index 10b6257..94dec95 100644
--- a/tests/test_format.py
+++ b/tests/test_format.py
@@ -1,9 +1,10 @@
 import datetime
 import re
+import time
 
 import pytest
 
-from fastjsonschema import JsonSchemaValueException
+from fastjsonschema import JsonSchemaValueException, compile
 
 
 exc = JsonSchemaValueException('data must be date-time', value='{data}', name='data', definition='{definition}', rule='format')
@@ -38,6 +39,58 @@ def test_datetime(asserter, value, expected):
     asserter({'type': 'string', 'format': 'date-time'}, value, expected)
 
 
+exc = JsonSchemaValueException('data must be email', value='{data}', name='data', definition='{definition}', rule='format')
+@pytest.mark.parametrize('value, expected', [
+    ('', exc),
+    ('bla', exc),
+    ('.john@example.com', exc),
+    ('john.@example.com', exc),
+    ('jo..hn@example.com', exc),
+    ('jo..\nhn@example.com', exc),
+    ('john@example', exc),
+    ('john@.example', exc),
+    ('john@example.', exc),
+    ('john@exa@mple.com', exc),
+    ('a@' + 'a.' * 1000 + '@', exc),
+    ('john@example.com', 'john@example.com'),
+    ('john.doe@example.com', 'john.doe@example.com'),
+    ('john@.example.com', 'john@.example.com'),
+])
+def test_email(asserter, value, expected):
+    asserter({'type': 'string', 'format': 'email'}, value, expected)
+
+
+exc = JsonSchemaValueException('data must be idn-email', value='{data}', name='data', definition='{definition}', rule='format')
+@pytest.mark.parametrize('value, expected', [
+    ('', exc),
+    ('bla', exc),
+    ('john@example', exc),
+    ('john@.example', exc),
+    ('john@example.', exc),
+    ('john@exa@mple.com', exc),
+    ('a@a' + '.' * 1000 + '@', exc),
+    ('jöhn@exämple.com', 'jöhn@exämple.com'),
+    ('john@.example.com', 'john@.example.com'),
+])
+def test_idn_email(asserter, value, expected):
+    asserter({
+        '$schema': 'http://json-schema.org/draft-07/schema',
+        'format': 'idn-email',
+    }, value, expected)
+
+
+@pytest.mark.parametrize('format_, value', [
+    ('email', 'a@' + 'a.' * 25000 + '@'),
+    ('idn-email', 'a@a' + '.' * 50000 + '@'),
+])
+def test_email_long_input_is_rejected_quickly(format_, value):
+    validator = compile({'$schema': 'http://json-schema.org/draft-07/schema', 'format': format_})
+    start = time.perf_counter()
+    with pytest.raises(JsonSchemaValueException):
+        validator(value)
+    assert time.perf_counter() - start < 1
+
+
 exc = JsonSchemaValueException('data must be hostname', value='{data}', name='data', definition='{definition}', rule='format')
 @pytest.mark.parametrize('value, expected', [
     ('', exc),