$ the-wire · showcase
Five Pydantic validation bypasses and a quadratic URL check
By RepoJournal · Filed · About FastAPI & Pydantic · Composed from the cited sources · methodology
Pydantic closed five validation holes that let malformed or oversized input slip past model checks, four of them allowing extra data to be accepted where it should have been rejected.
Quadratic time and memory multi-host URL validation pydantic/pydantic
Multi-host URL validation no longer runs in quadratic time and memory, so adversarial URLs that previously made the check blow up in cost are now bounded. Any service validating user-supplied URLs is the exposed surface.
Unbounded exponent in Fraction validation pydantic/pydantic
Fraction validation previously accepted an unbounded exponent, letting a crafted numeric literal drive the validator into disproportionate work. The fix caps what the exponent is allowed to reach.
Validation bypass of extra data keys in JSON model validation pydantic/pydantic
JSON model validation could be bypassed so extra data keys were accepted despite the model's configuration. Schemas that relied on that check to strip unknown fields were silently passing them through.
Validation bypass of aliased fields in TypedDict and dataclasses allowing extra data pydantic/pydantic
TypedDict and dataclass validation could be bypassed through aliased fields, letting extra data into structures that should have rejected it. Code depending on those types to enforce a closed set of keys was not enforcing it.
Validation bypass of Pydantic V1 dataclasses allowing extra data pydantic/pydantic
The Pydantic V1 dataclass path carries the same extra-data bypass, so projects still running V1 code get the equivalent fix.
Action items
- → Upgrade pydantic to a release containing the URL, Fraction, JSON model, TypedDict/dataclass, and V1 dataclass validat... pydantic/pydantic [immediate]
