Patched code sample

import re
import time
import marshmallow as m

# This code demonstrates the fix for a Denial of Service (DoS) vulnerability
# in Marshmallow's Email validator, as described in CVE-2024-22195.
# The user's prompt referenced a fictional CVE-2025-68480, but its
# description matches the real CVE-2024-22195.
#
# The vulnerability was due to "catastrophic backtracking" in the email
# validation regular expression. A specially crafted string could cause
# disproportionately high CPU usage. The fix was to replace the
# vulnerable regex with a more efficient one.

# --- 1. Define the Vulnerable and Patched Components ---

# The vulnerable Email validator using the old regex pattern
class VulnerableEmail(m.validate.Validator):
    _RE = re.compile(
        r"(^[-!#$%&'*+/=?^_`{}|~0-9a-zA-Z]+(\.[-!#$%&'*+/=?^_`{}|~0-9a-zA-Z]+)*"  # dot-atom
        r'|^"([\001-\010\013\014\016-\037!#-\[\]-\177]|\\[\001-011\013\014\016-\177])*"'  # quoted-string
        r")@(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}\.?$",
        re.IGNORECASE,
    )

    def _format_error(self, value):
        return "Not a valid email address."

    def __call__(self, value):
        if not self._RE.match(value):
            raise m.ValidationError(self._format_error(value))
        return value

# The patched Email validator, representing the fix.
# The new regex is adapted from the W3C HTML5 spec and avoids catastrophic backtracking.
class PatchedEmail(m.validate.Validator):
    _RE = re.compile(
        r"^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+"
        r"@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?"
        r"(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$",
        re.IGNORECASE,
    )

    def _format_error(self, value):
        return "Not a valid email address."

    def __call__(self, value):
        if not self._RE.match(value):
            raise m.ValidationError(self._format_error(value))
        return value

# Schemas using the vulnerable and patched validators
class VulnerableUserSchema(m.Schema):
    email = m.fields.Email(validate=VulnerableEmail(), required=True)

class PatchedUserSchema(m.Schema):
    email = m.fields.Email(validate=PatchedEmail(), required=True)


# --- 2. Prepare the Payload and Demonstrate the Fix ---

# A "malicious" string designed to trigger catastrophic backtracking in the vulnerable regex.
# It consists of many valid characters followed by one invalid character.
malicious_email_string = "a" * 50 + "!"

# A moderately sized payload using the malicious string.
# The `many=True` argument is key to the DoS attack, as it processes a list.
payload = [{"email": malicious_email_string}] * 200

# Instantiate the schemas
vulnerable_schema = VulnerableUserSchema()
patched_schema = PatchedUserSchema()

print("Demonstrating DoS vulnerability and fix for Marshmallow Email validation.")
print(f"Using a payload of {len(payload)} items with email: '{malicious_email_string}'")
print("-" * 60)

# --- Time the VULNERABLE version ---
try:
    print("Testing VULNERABLE schema...")
    start_time = time.perf_counter()
    vulnerable_schema.load(payload, many=True)
except m.ValidationError as e:
    # A validation error is expected, but the key is how long it takes to get here.
    end_time = time.perf_counter()
    duration = end_time - start_time
    print(f"VULNERABLE schema processing time: {duration:.4f} seconds.")
    # We still print the error to show it was caught correctly.
    # print(f"Validation Error (first 10): {e.messages['_schema'][:10]}")

# --- Time the PATCHED version ---
try:
    print("\nTesting PATCHED schema...")
    start_time = time.perf_counter()
    patched_schema.load(payload, many=True)
except m.ValidationError as e:
    # The patched version is also expected to fail validation, but extremely quickly.
    end_time = time.perf_counter()
    duration = end_time - start_time
    print(f"PATCHED schema processing time:    {duration:.4f} seconds.")
    # print(f"Validation Error (first 10): {e.messages['_schema'][:10]}")

print("-" * 60)
print("The patched schema processes the malicious payload almost instantly, "
      "while the vulnerable schema takes a disproportionately long time, "
      "demonstrating the fix.")