in reply to Re: hash collision DOS
in thread hash collision DOS

But doesn't CGI store fields internally as a hash?

From CGI 2.81:

sub param {
    my($self,@p) = self_or_default(@_);
    return $self->all_parameters unless @p;
    my($name,$value,@other);
#~~~~~Snip~~~~~
    ($name,$value,@other) = rearrange([NAME,[DEFAULT,VALUE,VALUES]],@p
+);
#~~~~~Snip~~~~~
    return wantarray ? @{$self->{$name}} : $self->{$name}->[0];
}

[download]

It also looks like CGI::Simple does the same:

From CGI::Simple 0.06

sub param {
    my ( $self, $param, @p ) = @_;
#~~~~~Snip~~~~~
    return wantarray ? @{$self->{$param}} : $self->{$param}->[0];
}

[download]
How do I love -d? Let me count the ways...

Replies are listed 'Best First'.
Re: Re: Re: hash collision DOS
by crazyinsomniac (Prior) on Jun 02, 2003 at 13:50 UTC
[reply]
      It doesn't have anything to do with the Vars() method. The worst-case performance of the hash slows down insertion of elements. CGI.pm inserts parameter names as keys when parsing the query string.
[reply]
        Look at this 
        C:\>perl -MData::Dumper -MCGI -e"die Dumper( CGI->new( { 1..10 }) ) "
$VAR1 = bless( {
                 '.charset' => 'ISO-8859-1',
                 '1' => [
                          2
                        ],
                 '3' => [
                          4
                        ],
                 'escape' => 1,
                 '5' => [
                          6
                        ],
                 '7' => [
                          8
                        ],
                 '.parameters' => [
                                    '7',
                                    '9',
                                    '1',
                                    '3',
                                    '5'
                                  ],
                 '9' => [
                          10
                        ],
                 '.fieldnames' => {}
               }, 'CGI' );

C:\>

        [download]
        Do all the keys map to one bucket? I'm pretty sure they don't. 
        C:\>perl -MData::Dumper -MCGI -e"warn Dumper( $a=CGI->new );die Dumper
+(scalar $a->Vars() ) " a= b= c= d= e= f= g=
$VAR1 = bless( {
                 '.charset' => 'ISO-8859-1',
                 'a' => [
                          ''
                        ],
                 'escape' => 1,
                 'b' => [
                          ''
                        ],
                 'c' => [
                          ''
                        ],
                 'd' => [
                          ''
                        ],
                 'e' => [
                          ''
                        ],
                 'f' => [
                          ''
                        ],
                 'g' => [
                          ''
                        ],
                 '.parameters' => [
                                    'a',
                                    'b',
                                    'c',
                                    'd',
                                    'e',
                                    'f',
                                    'g'
                                  ],
                 '.fieldnames' => {}
               }, 'CGI' );
$VAR1 = {
          'a' => '',
          'b' => '',
          'c' => '',
          'd' => '',
          'e' => '',
          'f' => '',
          'g' => ''
        };

        [download]
        The only way all the various keys would map to one bucket would be when you construct a hash by calling Vars. Do you see what I'm saying, or did I miss something crucial.
        update: I improved the 2nd snippet. Now it shows all the various keys going to a single bucket.

        update: Why not just post the example?

         
        ______crazyinsomniac_____________________________
        Of all the things I've lost, I miss my mind the most.
        perl -e "$q=$_;map({chr unpack qq;H*;,$_}split(q;;,q*H*));print;$q/$q;"

[reply]
[d/l]
[select]

In Section Seekers of Perl Wisdom