gh-109638: Fix exponential time in csv.Sniffer for doubled quotes

The regular expression which looks for a doubled quote character let
its runs match the quote character too, so every quote could be taken
either as a part of a run or as one of the matched quotes.  Exclude the
quote character from the runs and match them possessively.

The runs no longer exclude the delimiter and the line break either, so
a doubled quote is now also found in a field which contains them.

Author: serhiy-storchaka

Lib/csv.py

@@ -331,10 +331,12 @@ def _guess_quote_and_delimiter(self, data, delimiters):
         # if we see an extra quote between delimiters, we've got a
         # double quoted format
         dq_regexp = re.compile(
-                               r"((%(delim)s)|^)\W*%(quote)s[^%(delim)s\n]*%(quote)s[^%(delim)s\n]*%(quote)s\W*((%(delim)s)|$)" % \
-                               {'delim':re.escape(delim), 'quote':quotechar}, re.MULTILINE)
-
-
+                r"(?:%(delim)s|^) *+%(quote)s"              # ,"
+                r"[^%(quote)s]*+%(quote)s%(quote)s"         # the doubled quote
+                r"(?:%(quote)s%(quote)s|[^%(quote)s]++)*+"  # the rest of the field
+                r"%(quote)s(?:%(delim)s|$)"                 # ",
+                % {'delim': re.escape(delim), 'quote': quotechar},
+                re.MULTILINE)
 
         if dq_regexp.search(data):
             doublequote = True

Lib/test/test_csv.py

@@ -1564,6 +1564,13 @@ def test_zero_mode_tie_order_colon_first(self):
             sniffer.sniff(sample)
 
 
+    def test_sniff_regex_backtracking(self):
+        # gh-109638: this artificial sample used to take minutes.
+        sniffer = csv.Sniffer()
+        sample = '"",' * 100 + '"' * 100 + '0' + '"' * 100 + '0'
+        self.assertEqual(sniffer.sniff(sample).delimiter, ',')
+
+
 class NUL:
     def write(s, *args):
         pass

Misc/NEWS.d/next/Library/2026-07-29-11-25-00.gh-issue-109638.Vt2Rn9.rst

@@ -0,0 +1,3 @@
+Fix exponential time in :meth:`csv.Sniffer.sniff` for a sample which contains
+many quote characters.  A doubled quote character is now also detected in
+a field which contains the delimiter or a line break.