{"action":"created","issue":{"url":"https://api.github.com/repos/louisremi/memoize-immutable/issues/2","repository_url":"https://api.github.com/repos/louisremi/memoize-immutable","labels_url":"https://api.github.com/repos/louisremi/memoize-immutable/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/louisremi/memoize-immutable/issues/2/comments","events_url":"https://api.github.com/repos/louisremi/memoize-immutable/issues/2/events","html_url":"https://github.com/louisremi/memoize-immutable/issues/2","id":155550971,"number":2,"title":"possible key collisions","user":{"login":"graphicore","id":393132,"avatar_url":"https://avatars.githubusercontent.com/u/393132?v=3","gravatar_id":"","url":"https://api.github.com/users/graphicore","html_url":"https://github.com/graphicore","followers_url":"https://api.github.com/users/graphicore/followers","following_url":"https://api.github.com/users/graphicore/following{/other_user}","gists_url":"https://api.github.com/users/graphicore/gists{/gist_id}","starred_url":"https://api.github.com/users/graphicore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/graphicore/subscriptions","organizations_url":"https://api.github.com/users/graphicore/orgs","repos_url":"https://api.github.com/users/graphicore/repos","events_url":"https://api.github.com/users/graphicore/events{/privacy}","received_events_url":"https://api.github.com/users/graphicore/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-18T16:50:59Z","updated_at":"2016-05-19T11:24:39Z","closed_at":"2016-05-19T09:44:28Z","body":"I had a look at the code. The one issue is that a string argument could, similar to an SQL injection, escape it’s “boundaries” and change the meaning of the key.\r\n\r\nI.e. your separator is `_///_` a string like `\"hello_///_5\"`  would inject the reference to the object with the id 5.\r\n\r\nWith other words, two different inputs could create the same key. This is probably not going to be a problem if not done intentionally (with that longish separator at least), but it is possible.\r\n\r\nWhat you could do is either some escaping in strings of the separator (for ease it could be just one char, like a comma then) and of the escape character. i.e `stringVal = stringVal.replace(/_/g, ‘__’).replace(/,/g, ‘_,’)` *(at least I think that should work maybe I'm missing something)* escape is `\"_\"` and the key separator is `“,”` the escape character is escaped first, so that newly inserted escape characters as in `\"_,\"` are not escaped themselves.\r\n\r\nAnother approach is to use a hashing function for string values. If you use something not cryptographically secure you may have good speed but add potential collisions (back to square one). I think hash map implementations work around these collisions … the textbooks are full with hashing algorithms, some are maybe sufficient. This collision problem of hashing functions is similar to the initial problem. Uh, and hashing function could reduce your key size but the trade off is execution speed."},"comment":{"url":"https://api.github.com/repos/louisremi/memoize-immutable/issues/comments/220297138","html_url":"https://github.com/louisremi/memoize-immutable/issues/2#issuecomment-220297138","issue_url":"https://api.github.com/repos/louisremi/memoize-immutable/issues/2","id":220297138,"user":{"login":"graphicore","id":393132,"avatar_url":"https://avatars.githubusercontent.com/u/393132?v=3","gravatar_id":"","url":"https://api.github.com/users/graphicore","html_url":"https://github.com/graphicore","followers_url":"https://api.github.com/users/graphicore/followers","following_url":"https://api.github.com/users/graphicore/following{/other_user}","gists_url":"https://api.github.com/users/graphicore/gists{/gist_id}","starred_url":"https://api.github.com/users/graphicore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/graphicore/subscriptions","organizations_url":"https://api.github.com/users/graphicore/orgs","repos_url":"https://api.github.com/users/graphicore/repos","events_url":"https://api.github.com/users/graphicore/events{/privacy}","received_events_url":"https://api.github.com/users/graphicore/received_events","type":"User","site_admin":false},"created_at":"2016-05-19T11:24:39Z","updated_at":"2016-05-19T11:24:39Z","body":"Right, you'd have to exploit it consciously.\r\n\r\nIf someone in the future, by pure chance runs into it. One way to provide a solution would be to have an optional `stringHashingFunction` argument. If it's there call it with all raw strings and use the result, otherwise the use the raw strings directly."}}