Avoid quadratic backtracking in email and idn-email format regexes

CHANGELOG.txt

@@ -1,6 +1,7 @@
 === UNRELEASED
 
 * Fixed `$` in `patternProperties` matching before a trailing newline, which also made a `pattern` with the same regex accept a trailing newline
+* Fixed quadratic backtracking in the `email` and `idn-email` format regexes on long invalid strings
 
 === 2.22.3 (2026-11-01)
 

fastjsonschema/draft04.py

@@ -34,7 +34,7 @@ class CodeGeneratorDraft04(CodeGenerator):
     # library. Some regexps are not 100% precise but good enough, fast and without dependencies.
     FORMAT_REGEXS = {
         'date-time': r'^(?:' + DATE_REGEX + r')(t|T)(?:[01]\d|2[0-3]):[0-5]\d:(?:[0-5]\d|60)(?:\.\d+)?(?:[+-](?:[01]\d|2[0-3]):[0-5]\d|[+-](?:[01]\d|2[0-3])[0-5]\d|z|Z)\Z',
-        'email': r'^(?!.*\.\..*@)[^@.][^@]*(?<!\.)@[^@]+\.[^@]+\Z',
+        'email': r'^[^@.]+(?:\.[^@.]+)*@(?=[^@][^@.]*\.[^@])[^@]+\Z',
         'hostname': r'^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]{0,61}[A-Za-z0-9])\Z',
         'ipv4': r'^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\Z',
         'ipv6': r'^(?:(?:[0-9A-Fa-f]{1,4}:){6}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|::(?:[0-9A-Fa-f]{1,4}:){5}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){4}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,1}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){3}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,2}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:){2}(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,3}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}:(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,4}[0-9A-Fa-f]{1,4})?::(?:[0-9A-Fa-f]{1,4}:[0-9A-Fa-f]{1,4}|(?:(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))|(?:(?:[0-9A-Fa-f]{1,4}:){,5}[0-9A-Fa-f]{1,4})?::[0-9A-Fa-f]{1,4}|(?:(?:[0-9A-Fa-f]{1,4}:){,6}[0-9A-Fa-f]{1,4})?::)\Z',

fastjsonschema/draft07.py

@@ -8,7 +8,7 @@ class CodeGeneratorDraft07(CodeGeneratorDraft06):
         'date': r'^(?:' + DATE_REGEX + r')\Z',
         'iri': r'^\w+:(\/?\/?)[^\s]+\Z',
         'iri-reference': r'^(\w+:(\/?\/?))?[^#\\\s]*(#[^\\\s]*)?\Z',
-        'idn-email': r'^[^@]+@[^@]+\.[^@]+\Z',
+        'idn-email': r'^[^@]+@(?=[^@][^@.]*\.[^@])[^@]+\Z',
         # pylint: disable=line-too-long
         'idn-hostname': r'^(?!-)(xn--)?[a-zA-Z0-9][a-zA-Z0-9-_]{0,61}[a-zA-Z0-9]{0,1}\.(?!-)(xn--)?([a-zA-Z0-9\-]{1,50}|[a-zA-Z0-9-]{1,30}\.[a-zA-Z]{2,})$',
         'relative-json-pointer': r'^(?:0|[1-9][0-9]*)(?:#|(?:\/(?:[^~/]|~0|~1)*)*)\Z',

tests/test_format.py

@@ -1,9 +1,10 @@
 import datetime
 import re
+import time
 
 import pytest
 
-from fastjsonschema import JsonSchemaValueException
+from fastjsonschema import JsonSchemaValueException, compile
 
 
 exc = JsonSchemaValueException('data must be date-time', value='{data}', name='data', definition='{definition}', rule='format')
@@ -38,6 +39,58 @@ def test_datetime(asserter, value, expected):
     asserter({'type': 'string', 'format': 'date-time'}, value, expected)
 
 
+exc = JsonSchemaValueException('data must be email', value='{data}', name='data', definition='{definition}', rule='format')
+@pytest.mark.parametrize('value, expected', [
+    ('', exc),
+    ('bla', exc),
+    ('.john@example.com', exc),
+    ('john.@example.com', exc),
+    ('jo..hn@example.com', exc),
+    ('jo..\nhn@example.com', exc),
+    ('john@example', exc),
+    ('john@.example', exc),
+    ('john@example.', exc),
+    ('john@exa@mple.com', exc),
+    ('a@' + 'a.' * 1000 + '@', exc),
+    ('john@example.com', 'john@example.com'),
+    ('john.doe@example.com', 'john.doe@example.com'),
+    ('john@.example.com', 'john@.example.com'),
+])
+def test_email(asserter, value, expected):
+    asserter({'type': 'string', 'format': 'email'}, value, expected)
+
+
+exc = JsonSchemaValueException('data must be idn-email', value='{data}', name='data', definition='{definition}', rule='format')
+@pytest.mark.parametrize('value, expected', [
+    ('', exc),
+    ('bla', exc),
+    ('john@example', exc),
+    ('john@.example', exc),
+    ('john@example.', exc),
+    ('john@exa@mple.com', exc),
+    ('a@a' + '.' * 1000 + '@', exc),
+    ('jöhn@exämple.com', 'jöhn@exämple.com'),
+    ('john@.example.com', 'john@.example.com'),
+])
+def test_idn_email(asserter, value, expected):
+    asserter({
+        '$schema': 'http://json-schema.org/draft-07/schema',
+        'format': 'idn-email',
+    }, value, expected)
+
+
+@pytest.mark.parametrize('format_, value', [
+    ('email', 'a@' + 'a.' * 25000 + '@'),
+    ('idn-email', 'a@a' + '.' * 50000 + '@'),
+])
+def test_email_long_input_is_rejected_quickly(format_, value):
+    validator = compile({'$schema': 'http://json-schema.org/draft-07/schema', 'format': format_})
+    start = time.perf_counter()
+    with pytest.raises(JsonSchemaValueException):
+        validator(value)
+    assert time.perf_counter() - start < 1
+
+
 exc = JsonSchemaValueException('data must be hostname', value='{data}', name='data', definition='{definition}', rule='format')
 @pytest.mark.parametrize('value, expected', [
     ('', exc),