[safa-rk]

is_alpha_number() hands its argument straight to _maybe_strip_extension() with no length limit, unlike parse() which rejects anything over _MAX_INPUT_STRING_LENGTH. _EXTN_PATTERN is searched with a trailing $ anchor and every alternative starts with a separator run ([ \u00A0\t,]* or [- ]+), so for a long run of spaces or commas each start position scans to the end of the string before failing. That makes the call quadratic: is_alpha_number("800" + " " * n) takes about 0.15s at n=2000, 2.4s at 8000, 9.7s at 16000 and 57s at 32000 on CPython 3.9, so a few KB of form input pins a worker for seconds. A string longer than 250 chars can't be parsed, so it can't be a valid vanity number either; is_alpha_number now returns False for it before any regex work (0.000s for the same inputs). The cap lives in is_alpha_number because it is the only public entry point that reaches _maybe_strip_extension() with unbounded input; parse() already enforces the same limit.

The new assertion in testIsAlphaNumber returned True before the change (the padded string matched as a vanity number). make -C tools/python lint and test pass (308 tests).

[daviddrysdale]

Thanks!