Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7

@@ -7311,12 +7311,6 @@ public void resetDataAndSize(int newSize) {
                         RowContainer body = escalator.getBody();
                         int oldSize = body.getRowCount();
 
-                        // Hide all details.
-                        Set<Integer> oldDetails = new HashSet<>(visibleDetails);
-                        for (int i : oldDetails) {
-                            setDetailsVisible(i, false);
-                        }
-
                         if (newSize > oldSize) {
                             if (oldSize == 0 && !isHeaderVisible()) {
                                 // Fixes framework/issues/11607

@@ -0,0 +1,53 @@
+package com.vaadin.tests.components.grid;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.vaadin.data.provider.ListDataProvider;
+import com.vaadin.server.VaadinRequest;
+import com.vaadin.tests.components.AbstractTestUI;
+import com.vaadin.ui.Button;
+import com.vaadin.ui.Grid;
+import com.vaadin.ui.Label;
+import com.vaadin.ui.VerticalLayout;
+
+public class GridOpenDetailsAddRow extends AbstractTestUI {
+
+    @Override
+    protected void setup(VaadinRequest request) {
+        Grid<String> testGrid = new Grid<>();
+
+        testGrid.addColumn(item -> item).setCaption("column").setId("column");
+
+        List<String> list = new ArrayList<>();
+        list.add("row1");
+        list.add("row2");
+        list.add("row3");
+        ListDataProvider<String> dataProvider = new ListDataProvider<>(list);
+
+        testGrid.setDataProvider(dataProvider);
+        testGrid.setDetailsGenerator(item -> new Label("details - " + item));
+        list.forEach(item -> testGrid.setDetailsVisible(item, true));
+
+        Button addButton = new Button("add");
+        addButton.addClickListener(event -> {
+            String newItem = "row" + (list.size() + 1);
+            list.add(newItem);
+            testGrid.setDetailsVisible(newItem, true);
+            dataProvider.refreshAll();
+        });
+
+        VerticalLayout testLayout = new VerticalLayout(addButton, testGrid);
+        addComponent(testLayout);
+    }
+
+    @Override
+    protected Integer getTicketNumber() {
+        return 12106;
+    }
+
+    @Override
+    protected String getTestDescription() {
+        return "Already open details rows shouldn't disappear when a new row is added";
+    }
+}

@@ -0,0 +1,40 @@
+package com.vaadin.tests.components.grid;
+
+import static org.junit.Assert.assertEquals;
+
+import java.util.List;
+
+import org.junit.Test;
+import org.openqa.selenium.WebElement;
+
+import com.vaadin.testbench.By;
+import com.vaadin.testbench.elements.ButtonElement;
+import com.vaadin.tests.tb3.MultiBrowserTest;
+
+public class GridOpenDetailsAddRowTest extends MultiBrowserTest {
+
+    @Test
+    public void addRow() {
+        openTestURL();
+        waitUntilLoadingIndicatorNotVisible();
+
+        // confirm initial state
+        List<WebElement> spacers = findElements(By.className("v-grid-spacer"));
+        assertEquals("Unexpected initial amount of spacers", 3, spacers.size());
+
+        // add a row
+        $(ButtonElement.class).first().click();
+        waitUntilLoadingIndicatorNotVisible();
+
+        // ensure all existing spacers are still visible, as well as the new one
+        spacers = findElements(By.className("v-grid-spacer"));
+        assertEquals("Unexpected amount of spacers after adding a row", 4,
+                spacers.size());
+
+        assertEquals("Unexpected spacer contents for new row", "details - row4",
+                spacers.get(3).getText());
+
+        assertEquals("Unexpected spacer contents for first row",
+                "details - row1", spacers.get(0).getText());
+    }
+}

@@ -34,6 +34,12 @@
 @SuppressWarnings("serial")
 public class EmailValidator extends RegexpValidator {
 
+    private static final String PATTERN = "^" + "([a-zA-Z0-9_\\.\\-+])+" // local
+            + "@" + "[a-zA-Z0-9-.]+" // domain
+            + "\\." + "[a-zA-Z0-9-]{2,}" // tld
+            + "$";
+
+     
     /**
      * Creates a validator for checking that a string is a syntactically valid
      * e-mail address.
@@ -42,7 +48,6 @@ public class EmailValidator extends RegexpValidator {
      *            the message to display in case the value does not validate.
      */
     public EmailValidator(String errorMessage) {
-        super("^([a-zA-Z0-9_\\.\\-+])+@(([a-zA-Z0-9-])+\\.)+([a-zA-Z0-9]{2,4})+$",
-                true, errorMessage);
+        super(PATTERN, true, errorMessage);
     }
 }

@@ -28,4 +28,10 @@ public void testEmailValidatorWithFaultyString() {
     public void testEmailValidatorWithOkEmail() {
         Assert.assertTrue(validator.isValid("my.name@email.com"));
     }
+
+    @Test
+    public void testEmailValidatorWithBadInput() {
+        Assert.assertFalse(validator.isValid("a@a.m5qRt8zLxQG4mMeu9yKZm5qRt8zLxQG4mMeu9yKZm5qRt8zLxQG4mMeu9yKZ&"));
+    }
+
 }