Fix ReDoS in email update regex (challenge 7, API4:2019)

api_views/users.py

@@ -140,10 +140,22 @@ def update_email(username):
         return Response(error_message_helper(resp), 401, mimetype="application/json")
     else:
         user = User.query.filter_by(username=resp['sub']).first()
-        if vuln:  # Regex DoS
-            match = re.search(
-                r"^([0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*@{1}([0-9a-zA-Z][-\w]*[0-9a-zA-Z]\.)+[a-zA-Z]{2,9})$",
-                str(request_data.get('email')))
+        if vuln:  # Regex DoS - fixed: the previous pattern nested two unbounded
+            # quantifiers over overlapping character classes (`([-.\w]*[0-9a-zA-Z])*`),
+            # which is classic catastrophic-backtracking territory. Below, every
+            # repetition is capped to a small bound, so even a pathological, very
+            # long input can only ever produce a bounded (not exponential) amount
+            # of backtracking work. A hard length cap is added as well, since no
+            # regex-only fix can be relied on to stay cheap for unbounded input.
+            email_input = str(request_data.get('email'))
+            if len(email_input) > 254:
+                match = None
+            else:
+                match = re.fullmatch(
+                    r"[0-9a-zA-Z][0-9a-zA-Z._-]{0,63}@[0-9a-zA-Z]"
+                    r"(?:[0-9a-zA-Z-]{0,61}[0-9a-zA-Z])?"
+                    r"(?:\.[0-9a-zA-Z](?:[0-9a-zA-Z-]{0,61}[0-9a-zA-Z])?){1,8}",
+                    email_input)
             if match:
                 user.email = request_data.get('email')
                 db.session.commit()