[Backport] Add max length check to validate_email (#7673)

pydantic · Sep 27, 2023 · 59d8f38 · 59d8f38
1 parent 69b92b5
commit 59d8f38
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 0 deletions.
diff --git a/changes/7673-hramezani.md b/changes/7673-hramezani.md
@@ -0,0 +1 @@
+Fix: Add max length check to `pydantic.validate_email`
diff --git a/pydantic/networks.py b/pydantic/networks.py
@@ -702,6 +702,10 @@ def validate(cls, value: NetworkType) -> Union[IPv4Network, IPv6Network]:
 
 
 pretty_email_regex = re.compile(r'([\w ]*?) *<(.*)> *')
+MAX_EMAIL_LENGTH = 2048
+"""Maximum length for an email.
+A somewhat arbitrary but very generous number compared to what is allowed by most implementations.
+"""
 
 
 def validate_email(value: Union[str]) -> Tuple[str, str]:
@@ -714,6 +718,10 @@ def validate_email(value: Union[str]) -> Tuple[str, str]:
     """
     if email_validator is None:
         import_email_validator()
+
+    if len(value) > MAX_EMAIL_LENGTH:
+        raise errors.EmailError()
+
     m = pretty_email_regex.fullmatch(value)
     name: Union[str, None] = None
     if m:

diff --git a/tests/test_networks.py b/tests/test_networks.py
@@ -789,6 +789,7 @@ def test_address_valid(value, name, email):
         '\"@example.com',
         ',@example.com',
         'foobar <foobar<@example.com>',
+        'foobar <' + 'a' * 4096 + '@example.com>',
     ],
 )
 def test_address_invalid(value):