Fix RecursionError in Component.__repr__ on deeply nested calendars (Closes #1370)

[gistrec]

Problem

Component.__repr__ (in src/icalendar/cal/component.py) is recursive over self.subcomponents. Combined with the fact that the parser places no limit on BEGIN/END nesting depth, a ~13 KB crafted .ics is enough to make repr() / str() / f"{cal}" raise RecursionError at the default Python recursion limit (1000). Threshold is depth ≈ 498.

from_ical(), walk(), and to_ical() are unaffected — those code paths are already iterative.

Realistic exposure: anywhere a logger / error reporter / debug page formats an attacker-controlled Calendar object through repr(). CalDAV servers, .ics import endpoints, and calendar-invitation processors are the typical consumers.

The OSS-Fuzz harness exercises from_ical() / walk() / to_ical() but does not exercise __repr__, which is why this path was not surfaced by fuzzing.

Change

Replace the recursive __repr__ with an iterative stack-based walk. The output format is intentionally identical to the previous implementation for normally-shaped calendars (VCALENDAR({...}, VEVENT({...}), VEVENT({...}))); only the implementation strategy changes.

The PR is intentionally minimal: I am not adding a parser-side depth limit in handle_begin_component here. That would be a sensible defense-in-depth, but it changes acceptance semantics (currently-valid inputs would start being rejected), which deserves a separate discussion.

Tests

Added src/icalendar/tests/test_repr_recursion.py covering:

• repr() succeeds at depths [10, 100, 500, 1000] (parametrized) — previously crashed for any depth ≥ ~498.
• str() succeeds at depth 800 (it falls through to __repr__).
• Output format is unchanged for a normally-shaped calendar with two sibling VEVENTs.

Local result: 9451 passed, 736 skipped (was 9444 passed; the +7 are the new tests, parametrized count). No existing test changes.

Reproducer (matches issue)

import icalendar

depth = 500
ics = (
    "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//x//x//EN\r\n"
    + "BEGIN:VEVENT\r\n" * depth
    + "UID:nested@example.com\r\nDTSTAMP:20260101T000000Z\r\n"
    + "END:VEVENT\r\n" * depth
    + "END:VCALENDAR\r\n"
)
cal = icalendar.Calendar.from_ical(ics)
repr(cal)   # before: RecursionError; after: ~6 KB string

[read-the-docs-community]

Documentation build overview

📚 icalendar | 🛠️ Build #32750004 | 📁 Comparing 80594d2 against latest (7357cec)

  🔍 Preview build  

14 files changed · ± 14 modified

± Modified

• 404.html
• genindex.html
• contribute/index.html
• contribute/maintenance.html
• reference/changelog.html
• reference/api/icalendar.cal.alarm.html
• reference/api/icalendar.prop.dt.html
• reference/api/icalendar.prop.dt.period.html
• reference/api/icalendar.prop.recur.html
• reference/api/icalendar.prop.recur.weekday.html
• and 4 more...

[stevepiercy]

@gistrec thank you for your thorough analysis, code implementation, tests, and excellent comments. Would you please take a look at my minor suggestions, and update your branch against main?

Then I'd like a maintainer to review for final approval. @SashankBhamidi @angatha @niccokunzmann

[gistrec]

Fixed, ready for re-review, @angatha