validator.js email validation suspectible to ReDoS

[nubok]

Just call

validator.isEmail('"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');

and see what happens to the node.js engine (hint: it'll hang). Thus if Malory is able to make you call validator.isEmail(...) on a parameter he passed, he can do a DoS on a web appication using validator.js.

Background of this dangerous bug: http://en.wikipedia.org/wiki/ReDoS.

[Vadorequest]

Ouch. Thanks for pointing this out!
Basically I lost my tab and my I7 processor went crazy up to 25% with a single tab. Didn't try server side but I believe in the DoS issue.

[chriso]

Dupe of #152.