Add tests from PR, update CHANGELOG and AUTHORS.

Author: andialbrecht

AUTHORS

@@ -12,6 +12,7 @@ Alphabetical list of contributors:
 * Aki Ariga <chezou+github@gmail.com>
 * Alexander Beedie <ayembee@gmail.com>
 * Alexey Malyshev <nostrict@gmail.com>
+* alhudz <al.hudz.k@gmail.com>
 * ali-tny <aliteeney@googlemail.com>
 * andrew deryabin <github@djsf.com>
 * Andrew Tipton <andrew.tipton@compareglobalgroup.com>
@@ -77,6 +78,7 @@ Alphabetical list of contributors:
 * Tao Wang <twang2218@gmail.com>
 * Tenghuan <tenghuanhe@gmail.com>
 * Tim Graham <timograham@gmail.com>
+* tonghuaroot <tonghuaroot@users.noreply.github.com>
 * Victor Hahn <info@victor-hahn.de>
 * Victor Uriarte <vmuriart@gmail.com>
 * Ville Skyttä <ville.skytta@iki.fi>

CHANGELOG

@@ -7,6 +7,24 @@ Notable Changes
 * Migrate project dependencies and environment management from `pixi` to `uv`.
 * Replace `flake8` with `ruff` for code checking and linting.
 
+Security Fixes
+
+* Fix uncontrolled CPU consumption in ``TokenList`` grouping (CWE-1333,
+  patches by alhudz and tonghuaroot, pr848).  Two independent
+  quadratic behaviours were fixed:
+
+  - ``TokenList.__init__`` called ``str(self)`` which recursively flattened
+    the entire token subtree on every group construction.  Deeply nested SQL
+    (parentheses, CASE WHEN, subqueries) therefore costs O(n·depth) CPU
+    before the depth cap fires — a ~2 KB payload could pin a worker for 10+
+    seconds.  Fix: join children's already-cached ``value`` fields directly,
+    reducing per-node cost to O(len(tokens)).
+
+  - ``group_tokens()`` recomputed ``grp.value = str(start)`` on every extend
+    step, re-scanning the entire growing group each time.  Wide flat queries
+    (e.g. SELECT with thousands of columns) therefore cost O(N²) in the
+    number of columns.  Fix: append only the newly added tokens' values.
+
 Enhancements
 
 * Modernize type annotations in top-level API functions using PEP 585 and PEP 604 syntax.

benchmarks/bench_grouping.py

@@ -0,0 +1,59 @@
+"""Grouping performance benchmarks.
+
+Measures parse time for SQL patterns that stress the grouping engine:
+- Deeply nested parentheses
+- Deeply nested CASE WHEN expressions
+- Wide column lists (tests O(N) identifier grouping, fixed in PR848)
+
+Run with:  python benchmarks/bench_grouping.py
+"""
+
+import signal
+import time
+
+import sqlparse
+
+
+def _alarm_handler(signum, frame):
+    raise TimeoutError()
+
+
+signal.signal(signal.SIGALRM, _alarm_handler)
+
+
+def measure(label, sql, fn):
+    signal.alarm(30)
+    t0 = time.perf_counter()
+    status = 'OK'
+    try:
+        fn(sql)
+    except sqlparse.exceptions.SQLParseError:
+        status = 'CAP'
+    except TimeoutError:
+        status = 'TIMEOUT'
+    finally:
+        signal.alarm(0)
+    dt = (time.perf_counter() - t0) * 1000
+    print(f'  {status:8} {dt:8.1f} ms  {label}  ({len(sql)} B)')
+
+
+# Vector 1: deeply nested parentheses
+print('Nested parentheses:')
+for n in (200, 500, 1000, 2000):
+    sql = 'SELECT ' + '(' * n + '1' + ')' * n
+    measure(f'nested-paren n={n}', sql, sqlparse.parse)
+
+# Vector 2: deeply nested CASE WHEN
+print('Nested CASE WHEN:')
+for n in (100, 200, 400):
+    case = '1'
+    for i in range(n):
+        case = f'CASE WHEN x={i} THEN {case} ELSE NULL END'
+    measure(f'CASE-nested n={n}', f'SELECT {case} FROM t', sqlparse.parse)
+
+# Vector 3: wide column lists (O(N) grouping, regression fixed in PR848)
+print('Wide column lists:')
+for n in (500, 1000, 2000, 4000):
+    cols = ', '.join(f'col_{i}' for i in range(n))
+    sql = f'SELECT {cols} FROM t'
+    measure(f'wide-select n={n}', sql, sqlparse.parse)

tests/test_dos_prevention.py

@@ -50,6 +50,34 @@ def test_very_large_token_list_limited(self):
         with pytest.raises(SQLParseError, match="Maximum number of tokens exceeded"):
             sqlparse.format(sql, reindent=True)
 
+    def test_nested_paren_within_cap_under_1s(self):
+        """Reaching MAX_GROUPING_DEPTH must not require multi-second CPU.
+
+        Before the TokenList.__init__ fix, a 1 KB payload of 500 nested
+        parens took ~1.3 s and a 2 KB payload of 1000 nested parens took
+        ~11 s before the depth cap raised SQLParseError, because each
+        TokenList materialised its ``value`` via ``str(self)`` which
+        recursed over the full subtree (O(n * depth)).
+        """
+        sql = 'SELECT ' + '(' * 1000 + '1' + ')' * 1000
+        t0 = time.perf_counter()
+        with pytest.raises(SQLParseError, match='Maximum grouping depth'):
+            sqlparse.parse(sql)
+        dt = time.perf_counter() - t0
+        assert dt < 1.0, f'parse took {dt:.2f}s, expected sub-second'
+
+    def test_nested_case_within_cap_under_1s(self):
+        """Same invariant as nested parentheses, exercised via CASE WHEN."""
+        case = '1'
+        for i in range(400):
+            case = f'CASE WHEN x={i} THEN {case} ELSE NULL END'
+        sql = f'SELECT {case} FROM t'
+        t0 = time.perf_counter()
+        with pytest.raises(SQLParseError, match='Maximum grouping depth'):
+            sqlparse.parse(sql)
+        dt = time.perf_counter() - t0
+        assert dt < 1.0, f'parse took {dt:.2f}s, expected sub-second'
+
     def test_normal_sql_still_works(self):
         """Test that normal SQL still works correctly after DoS protections."""
         sql = """