[issue29535] datetime hash is deterministic in some cases

Change by Serhiy Storchaka : -- assignee: -> docs@python components: +Documentation nosy: +docs@python resolution: -> fixed stage: patch review -> resolved status: open -> closed type: security -> behavior versions: -Python 3.5, Python 3.6, Python 3.7

[issue29535] datetime hash is deterministic in some cases

miss-islington added the comment: New changeset 076d0b9f5def35aeb0f8e8aadf658dc35aace81d by Miss Islington (bot) in branch '3.8': bpo-29535: Remove promize about hash randomization of datetime objects. (GH-15269)

[issue29535] datetime hash is deterministic in some cases

Serhiy Storchaka added the comment: New changeset e9c90aa43144b0be1e4e393e8cb549573437a5da by Serhiy Storchaka in branch 'master': bpo-29535: Remove promize about hash randomization of datetime objects. (GH-15269)

[issue29535] datetime hash is deterministic in some cases

Change by miss-islington : -- pull_requests: +15148 pull_request: https://github.com/python/cpython/pull/15454 ___ Python tracker ___

[issue29535] datetime hash is deterministic in some cases

Ashwin Ramaswami added the comment: Oh, that PR is already there in PR 15269, great! -- ___ Python tracker ___ ___

[issue29535] datetime hash is deterministic in some cases

Ashwin Ramaswami added the comment: Makes sense, thanks for the explanation. The risk is that if there is code that, say, converts a POST dictionary to a dictionary with numeric keys, that code could be exploited. Creating a non-deterministic hash doesn't necessarily preclude hash(x) = x

[issue29535] datetime hash is deterministic in some cases

Change by STINNER Victor : -- nosy: +vstinner ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue29535] datetime hash is deterministic in some cases

Tim Peters added the comment: I'm with Mark: leave numeric hashes alone. There's no reason to change them, and in addition to what Mark wrote it's a positively Good Thing that `hash(i) == i` for all sufficiently small ints. Not only is that efficient to compute, it guarantees there are

[issue29535] datetime hash is deterministic in some cases

Mark Dickinson added the comment: > Why so? Python's hash needs to obey the invariant that `hash(x) == hash(y)` for any two hashable objects with `x == y`. That makes life particularly hard for numeric types, because there are a number of *different* numeric types where equality can hold

[issue29535] datetime hash is deterministic in some cases

Ashwin Ramaswami added the comment: > Making the numeric hash non-predictable while maintaining its current > properties would be difficult. Why so? > In fact, I think it's reasonable to assume that there are no websites > vulnerable to a DOS via *numeric* hash collisions until we see

[issue29535] datetime hash is deterministic in some cases

Mark Dickinson added the comment: > shouldn't numerics, datetime objects, and tuples be non-deterministically > hashed as well? [...] Making the numeric hash non-predictable while maintaining its current properties would be difficult. But fortunately, I don't think it's necessary. IIUC,

[issue29535] datetime hash is deterministic in some cases

Ashwin Ramaswami added the comment: Randomizing the hash of datetime objects was first proposed in https://bugs.python.org/issue13703#msg151796. For the same reasons as str and bytes are non-deterministically hashed in in PEP 456, shouldn't numerics, datetime objects, and tuples be

[issue29535] datetime hash is deterministic in some cases

Christian Heimes added the comment: PEP 456 explains why hash of str and bytes must be randomized. I don't know any reason why hash of datetime objects must be randomized. They can be deterministic like floats and ints. -- ___ Python tracker

[issue29535] datetime hash is deterministic in some cases

Ashwin Ramaswami added the comment: Why is it ok for certain hashes (such as tuples) to be not non-deterministic, while other hashes (such as datetime) need to be non-deterministic? -- ___ Python tracker

[issue29535] datetime hash is deterministic in some cases

Change by Serhiy Storchaka : -- nosy: +benjamin.peterson ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue29535] datetime hash is deterministic in some cases

Change by Serhiy Storchaka : -- pull_requests: +14991 pull_request: https://github.com/python/cpython/pull/15269 ___ Python tracker ___

[issue29535] datetime hash is deterministic in some cases

Serhiy Storchaka added the comment: Other option is to remove a note about datetime hash. It is an implementation detail. There are other objects with nondeterministic hash, for example tuples containing strings, but we should not document this explicitly or make the hash of all tuples

[issue29535] datetime hash is deterministic in some cases

Ashwin Ramaswami added the comment: I've added a PR which should fix this. Do you think the documentation should also be updated to change "By default, the :meth:`__hash__` values of str, bytes and datetime objects are "salted" with an unpredictable random value." to "By default, the

[issue29535] datetime hash is deterministic in some cases

Change by Ashwin Ramaswami : -- keywords: +patch pull_requests: +14983 stage: -> patch review pull_request: https://github.com/python/cpython/pull/15264 ___ Python tracker

[issue29535] datetime hash is deterministic in some cases

Change by Armin Rigo : -- nosy: -arigo ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue29535] datetime hash is deterministic in some cases

Change by Ashwin Ramaswami : -- nosy: +epicfaace versions: +Python 3.8, Python 3.9 ___ Python tracker ___ ___ Python-bugs-list

[issue29535] datetime hash is deterministic in some cases

Serhiy Storchaka added the comment: It looks to me that this difference is not intentional. This is just a consequence of the fact that __hash__ functions for some of these objects use the hash of the pickle state which is a bytes object. -- nosy: +serhiy.storchaka

[issue29535] datetime hash is deterministic in some cases

Raymond Hettinger added the comment: Rather than changing the documentation, I would prefer to have this fixed for date/time/datetiem unless MAL has a reason not to make the change. For timezone, I don't think we really care. For timedelta, it is reasonable to always be the same hash. It

[issue29535] datetime hash is deterministic in some cases

Changes by Armin Rigo : -- pull_requests: +2016 ___ Python tracker ___ ___

[issue29535] datetime hash is deterministic in some cases

Changes by Serhiy Storchaka : -- nosy: +belopolsky versions: +Python 3.6 ___ Python tracker ___

[issue29535] datetime hash is deterministic in some cases

Christian Heimes added the comment: I only checked Python 2.7. For Python 3.x it's a bit more complicated: timedelta: PyObject_Hash(), always the same hash value date: _Py_HashBytes(), always a randomized hash value time: _Py_HashBytes() for offset = None, PyObject_Hash() for offset != 0

[issue29535] datetime hash is deterministic in some cases

Armin Rigo added the comment: That's not what the docs say. E.g.: https://docs.python.org/3/reference/datamodel.html#object.__hash__ says By default, the __hash__() values of str, bytes and datetime objects are “salted” with an unpredictable random value. Although they remain constant

[issue29535] datetime hash is deterministic in some cases

Christian Heimes added the comment: Only the hash of str and bytes are randomized/ The types date, datetime and time are not subject to hash randomization. Same for int, float, bool and None. -- nosy: +christian.heimes ___ Python tracker

[issue29535] datetime hash is deterministic in some cases

New submission from Armin Rigo: The documentation on the hash randomization says that date, time and datetime have a hash based on strings, that is therefore nondeterministic in several runs of Python. I may either be missing a caveat, or the actual implementation does not follow its promise