fix quadratic backtracking in dehumanize unit search

arrow/arrow.py

@@ -1411,7 +1411,7 @@ def dehumanize(self, input_string: str, locale: str = "en_us") -> "Arrow":
                 search_string = search_string.format(r"\d+")
 
                 # Create search pattern and find within string
-                pattern = re.compile(rf"(^|\b|\d){search_string}")
+                pattern = re.compile(rf"(^|\b){search_string}")
                 match = pattern.search(input_string)
 
                 # If there is no match continue to next iteration

tests/test_arrow.py

@@ -2930,6 +2930,17 @@ def test_no_units_modified(self, locale_list_no_weeks: List[str]):
             with pytest.raises(ValueError):
                 arw.dehumanize(empty_future_string, locale=lang)
 
+    def test_long_malformed_input(self):
+        arw = arrow.Arrow(2000, 6, 18, 5, 55, 0)
+
+        # A long run of digits with no trailing time unit used to make the
+        # per-unit search regex backtrack quadratically (ReDoS). It must be
+        # rejected quickly, not hang.
+        start = time.time()
+        with pytest.raises(ValueError):
+            arw.dehumanize("9" * 50000)
+        assert time.time() - start < 1.0
+
     def test_slavic_locales(self, slavic_locales: List[str]):
         # Relevant units for Slavic locale plural logic
         units = [