Re: HashDoS
| From: | Yasuo Ohgaki | Date: | Wed, 21 Sep 2016 06:54:02 +0000 |
| Subject: | Re: HashDoS | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-96043@lists.php.net to get a copy of this message | ||
Hi Stas,
On Wed, Sep 21, 2016 at 11:26 AM, Stanislav Malyshev
<smalyshev@gmail.com> wrote:
>
>> I think we are better to limit max collisions.
>> I'm +1 for Nikita's proposal does this.
>
> Max collision per what? How much would be the limit?
Collision by keys.
It would be nice to have configurable limit like regex stack/backtrack limit.
That said, wouldn't 1000 enough for almost all apps?
Anyway, we have two choices
- Simply limit the number of collisions. (Fast and has no impact to code)
- Use crypt safe hash and salt. (Slow and has impact to opcache/etc)
Limiting something is good to have sometimes.
Python even limits number of recursions to 1000 by default.
We have PCRE stack/backtrack limits. (We'll have mbregex stack limit soon)
Collision limit is good one also.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net