same output for 2 different input about hashids HOT 2 CLOSED

Hello,

The Problem
The problem stems from the fact that there's an internal separator list that is static, no matter the salt and alphabet used. This separator list is composed of the following characters cfhistuCFHISTU

From the alphabet supplied, the characters common with the separator list are first removed.
In your scenario, the alphabet used is aebJBdDEgGA (11 characters)

The salt on the other hand, isn't actually used as expected.
Only the first couple of characters are used. I have noticed that the salt used is smaller than the alphabet used by about 2 spots due to the way _consistent_shuffle works.

The Bigger problem
In your case, even the following salts will give the same ids:

That is because only the first 9 characters provide entropy :(

The Solution
In your scenario simply jumbling the alphabet will result in different hashes... due to the way the alphabet's character order impacts the initial state. (aAbBcCdDeEfFgGhHijJ vs abcdefghijABCDEFGHIJ or even a simpler AabBcCdDeEfFgGhHijJ)

On the long run, there appears to be an inherit issues in the way the salt impacts the final hashes.

I guess the best way to fix this would be to use the entire salt consistently...

Best Regards,
Khez

from hashids.

Hi @null-value and @Khez,

Sorry for getting back a bit late, been AFK for far too long. So, @Khez you're right in figuring out why the whole salt is not used when alphabet is short.

@null-value, this is actually a know "issue", when I've tested the code for randomness and consistent shuffle function I noticed that as well.

The reason I haven't adjusted it yet is because:

1. I haven't seen many cases (actually any, I guess you're first) where this has been an issue in projects.
2. If I adjust the consistent shuffle at this point, the output will change and this is too minor of a change in my opinion to cause a version bump (or ids to change).

Having said that, I've created a new issue for 1.1 milestone hashids/hashids.github.io#19 which I will try to tackle when updating the library as a whole.

In the meantime @null-value, if this is an issue in your project, I'd suggest either manually shuffling your own alphabet as @Khez pointed out, and/or picking unique initial characters in salt.

Cheers,
Ivan

from hashids.