mumurhash32 collision between ufo and vue

[danielroe]

require('ohash').hash('ufo')
// '2247144487'
require('ohash').hash('vue')
// '2247144487'

related: nuxt/framework#5398

[pi0]

Another collision:

/node_modules/vue-toastification/dist/index.css // 944007393
/node_modules/vue-toastification/dist/index.mjs // 944007393

Ref: nuxt/nuxt#14313

[pi0]

Using SHA2 in latest 0.1.x #12

[aleclarson]

Just a shot in the dark, but it seems collisions can be easily avoided with padEnd?

import { murmurHash } from 'ohash'

const fixedHash = (s) => murmurHash(s.padEnd(s.length + (4 - (s.length & 3)) & 3, '\0'))

fixedHash('vue') // => 2175094470
fixedHash('ufo') // => 3195201511

fixedHash('/node_modules/vue-toastification/dist/index.mjs')
// => 1385894279
fixedHash('/node_modules/vue-toastification/dist/index.css')
// => 3153126526

I'm not sure if this really fixes it or not, to be honest. :)

From this article:

No collisions are possible for 4-byte keys

So perhaps making sure that remainder is always zero fixes it? 😅

ohash/src/crypto/murmur.ts

Line 18 in 58a0d67

const remainder = key.length & 3 // key.length % 4

My hypothesis is basically, "No collisions exist for modulus 4 length strings." Again, no idea if it's sound.

[pi0]

Really nice point @aleclarson thanks for sharing article. Do you mind to open a PR directly adding fix to murmurHash function? (Also maybe few tests)