Repository navigation
validators.url hang #65
Description
When validating the following url, the call gets blocked and CPU spikes to 100%
$ pip freeze | grep validator
validators==0.12.0
$ python
Python 2.7.10 (default, Feb 7 2017, 00:08:15)
[GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.34)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import validators
>>> validators.url('http://172.20.201.135-10.10.10.1656172.20.11.80-10.10.10.1746172.16.9.13-192.168.17.68610.10.10.226-192.168.17.64610.10.10.226-192.168.17.63610.10.10.226-192.168.17.62610.10.10.226-192.168.17.61610.10.10.226-192.168.17.60610.10.10.226-192.168.17.59610.10.10.226-192.168.17.58610.10.10.226-192.168.17.57610.10.10.226-192.168.17.56610.10.10.226-192.168.17.55610.10.10.226-192.168.17.54610.10.10.226-192.168.17.53610.10.10.226-192.168.17.52610.10.10.226-192.168.17.51610.10.10.195-10.10.10.2610.10.10.194-192.168.17.685172.20.11.52-10.10.10.195510.10.10.226-192.168.17.50510.10.10.186-172.20.11.1510.10.10.165-198.41.0.54192.168.84.1-192.168.17.684192.168.222.1-192.168.17.684172.20.11.52-10.10.10.174410.10.10.232-172.20.201.198410.10.10.228-172.20.201.1983192.168.17.135-10.10.10.1423192.168.17.135-10.10.10.122310.10.10.224-172.20.201.198310.10.10.195-172.20.11.1310.10.10.160-172.20.201.198310.10.10.142-192.168.17.1352192.168.22.207-10.10.10.2242192.168.17.66-10.10.10.1122192.168.17.135-10.10.10.1122192.168.17.129-10.10.10.1122172.20.201.198-10.10.10.2282172.20.201.198-10.10.10.2242172.20.201.1-10.10.10.1652172.20.11.2-10.10.10.1412172.16.8.229-12.162.170.196210.10.10.212-192.168.22.133')Control+C breaking the execution shows the following stacks:
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "<decorator-gen-18>", line 2, in url
File "/Users/librah/virtualenv/w4cs/lib/python2.7/site-packages/validators/utils.py", line 78, in wrapper
value = func(*args, **kwargs)
File "/Users/librah/virtualenv/w4cs/lib/python2.7/site-packages/validators/url.py", line 108, in url
result = pattern.match(value)
KeyboardInterrupt
Activity
kvesteri commentedon Sep 26, 2017
Woah, PRs welcome for this!
librah commentedon Sep 29, 2017
@kvesteri I found it challenging for me to troubleshoot the regex that validating urls. I work around the issue via checking the hostname/ip max length first before using your URL validator.
m-novikov commentedon Oct 17, 2017
It looks like ReDoS case
Culprit is domain subexpression
vlad43210 commentedon Mar 9, 2023
Just found this same issue in 0.20.0. Any idea if this will be fixed / any workarounds?
maint: improves `url` module