conda / conda/ceps

BUG CEP-19: Different directory trees may end up with the same hash value

Open
#150 5 comments 0 reactions 1 assignee Claimed by @pb01ka View on GitHub
Dominant language
No language data
Stars
34
Forks
41
Avg merge
1h 46m
Merged PRs (30d)
1

Description

### Checklist

- [x] I added a descriptive title
- [x] I searched open reports and couldn't find a duplicate

### What happened?

I have set up two different directory trees:

```
|-- testdata1
| `-- testFhello-world
`-- testdata2
|-- test
`-- world
```

Using the python script from CEP-19 to hash these two trees, they both have the same hash value:

```
CEP19 hash of testdata1: e91a9f9adcb3561a7a78a04d6f33b391beb92491f9ed99663b455867b031d30a
CEP19 hash of testdata2: e91a9f9adcb3561a7a78a04d6f33b391beb92491f9ed99663b455867b031d30a
```

The file name `testFhello-world` in `testdata1` is added to the hash stream and is indistinguishable from a file name `test` with contents `hello` followed by a file `world` with whatever contents `testFhello-world` has. This is not the only way to confuse the algorithm: You can also use the contents of files to "pretend" there are more files.

One way to stop these filesystem trees from having the same hash value is to add the length of the input. You can do that either by hashing the length as an integer of a defined bit length or "stringified" followed by a separator like `:`. The separator is needed after a stringified value as without it the user provided contents may change that length by starting with digits. That might allow for another way to confuse the algorithm.

[cep-19-fail.tar.gz](https://github.com/user-attachments/files/24966440/cep-19-fail.tar.gz) has the script from CEP19 and the two directories so you can try for yourself.

### Additional Context

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.