EmailValidator catastrophic exponential-time regular expression

[vaadin-bot]

Originally by jtomaszk

---

Class com.vaadin.data.validator.EmailValidator is using unsafe validation regex

"^([a-zA-Z0-9_\\.\\-+])+@(([a-zA-Z0-9-])+\\.)+([a-zA-Z0-9]{2,4})+$"

example of potential malicious input that validation never ends:

a@a.m5qRt8zLxQG4mMeu9yKZm5qRt8zLxQG4mMeu9yKZm5qRt8zLxQG4mMeu9yKZ&

related info [http://www.regular-expressions.info/catastrophic.html]

---

Imported from https://dev.vaadin.com/ issue #20065

[fante76]

Current implementation on Vaadin8, gives validation error if value is an empty string, because it only test null value.

[cristian-aimi]

this second bug notificated by fante76 it's more serious because blocks the form tha has an EmailValidator inside. Would be better to fix the problem first as possible.

[stale[bot]]

Hello there!

It looks like this issue hasn't progressed lately. There are so many issues that we just can't deal them all within a reasonable timeframe.

There are a couple of things you could help to get things rolling on this issue (this is an automated message, so expect that some of these are already in use):

• Check if the issue is still valid for the latest version. There are dozens of duplicates in our issue tracker, so it is possible that the issue is already tackled. If it appears to be fixed, close the issue, otherwise report to the issue that it is still valid.
• Provide more details how to reproduce the issue.
• Explain why it is important to get this issue fixed and politely draw others attention to it e.g. via the forum or social media.
• Add a reduced test case about the issue, so it is easier for somebody to start working on a solution.
• Try fixing the issue yourself and create a pull request that contains the test case and/or a fix for it. Handling the pull requests is the top priority for the core team.
• If the issue is clearly a bug, use the Warranty in your Vaadin subscription to raise its priority.

Thanks again for your contributions! Even though we haven't been able to get this issue fixed, we hope you to report your findings and enhancement ideas in the future too!

[stale[bot]]

The issue was automatically closed due to inactivity. If you found some new details to it or started working on it, comment on the issue so that maintainers can re-open it.

[TatuLund]

For some reason this ticket has been left open although it has been addressed in Vaadin version 8 newer frameworks. The regexp pattern has been update to https://github.com/vaadin/framework/blob/bafab4554a43f7c0214e919fa9d594a92305bc92/server/src/main/java/com/vaadin/data/validator/EmailValidator.java#L29

I verified that problem with the given test pattern does not occur anymore.