gh-109638: Avoid pathological backtracking in csv.Sniffer

Author: Punisheroot

Lib/csv.py

@@ -331,7 +331,7 @@ def _guess_quote_and_delimiter(self, data, delimiters):
         # if we see an extra quote between delimiters, we've got a
         # double quoted format
         dq_regexp = re.compile(
-                               r"((%(delim)s)|^)\W*%(quote)s[^%(delim)s\n]*%(quote)s[^%(delim)s\n]*%(quote)s\W*((%(delim)s)|$)" % \
+                               r"((%(delim)s)|^)\W*%(quote)s[^%(delim)s%(quote)s\n]*%(quote)s[^%(delim)s\n]*%(quote)s\W*((%(delim)s)|$)" % \
                                {'delim':re.escape(delim), 'quote':quotechar}, re.MULTILINE)
 
 

Lib/test/test_csv.py

@@ -1501,6 +1501,12 @@ def test_delimiters(self):
         self.assertEqual(dialect.delimiter, ',')
         self.assertEqual(dialect.quotechar, '"')
 
+    def test_sniff_regex_backtracking(self):
+        # gh-109638: this artificial sample used to take minutes.
+        sniffer = csv.Sniffer()
+        sample = '"",' * 100 + '"' * 100 + '0' + '"' * 100 + '0'
+        self.assertEqual(sniffer.sniff(sample).delimiter, ',')
+
     def test_doublequote(self):
         sniffer = csv.Sniffer()
         dialect = sniffer.sniff(self.header1)

Misc/NEWS.d/next/Library/2026-07-29-13-00-00.gh-issue-109638.SnifF1.rst

@@ -0,0 +1,2 @@
+Prevent pathological regular expression backtracking in :class:`csv.Sniffer`
+when detecting doubled quote characters.