You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Include baseURL in URL's hash calculation along with relativeString
Motivation:
In scenarios where a URL is expressing a common path (e.g., https://example.com/robots.txt), multiple individual URLs might be created with the same relativeString but different baseURL. Currently, the hash of these instances will all be the same, despite them having a different baseURL. If URLs like these are used as keys in a Dictionary, this will lead to O(N) lookup costs which has performance implications and could introduce a denial-of-service attack vector.
marcprux@skipbox:~$ swiftly run swift repl
Welcome to Swift version 6.3-dev (LLVM 4f7a3dbb7e97ac4, Swift 477d32c08627ddd).
Type :help for assistance.
1> import Foundation
2> URL(string: "robots.txt", relativeTo: URL(string: "https://example.com")).hashValue
$R0: Int = 4059451536836375387
3> URL(string: "robots.txt", relativeTo: URL(string: "https://example.org")).hashValue
$R1: Int = 4059451536836375387
Modifications:
Add baseURL to URL's hash calculation.
Result:
The hash will be improved.
Testing:
hashIncludesBaseURL in Tests/FoundationEssentialsTests/URLTests.swift
I'll also note that this behavior matches CFURL's __CFURLHash , which hashes on the entire string representation of the URL (CFHash(CFURLGetString((CFURLRef)cf))) rather than just the relativeString. Oops, it doesn't, as the subsequent comment points out.
CFURLGetString only returns the relative string, so we would be deviating from that, but that's probably okay. This should also be okay performance-wise since the baseURL is guaranteed to be absolute, i.e. we won't do a ton of recursing. Though we could also be explicit about using baseURL?.relativeString if necessary.
The motivation makes sense and should be good implementation-wise. @marcprux do you want to resolve the merge conflict (probably a test I added, sorry!), then we'll get this tested and merged?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Include
baseURLin URL's hash calculation along with relativeStringMotivation:
In scenarios where a URL is expressing a common path (e.g.,
https://example.com/robots.txt), multiple individual URLs might be created with the samerelativeStringbut differentbaseURL. Currently, thehashof these instances will all be the same, despite them having a differentbaseURL. If URLs like these are used as keys in a Dictionary, this will lead to O(N) lookup costs which has performance implications and could introduce a denial-of-service attack vector.Modifications:
Add
baseURLto URL'shashcalculation.Result:
The hash will be improved.
Testing:
hashIncludesBaseURLinTests/FoundationEssentialsTests/URLTests.swift