See also the :option:`-R` command-line option.

.. cmdoption:: -R

Turn on hash randomization, so that the :meth:`__hash__` values of str,

bytes and datetime objects are "salted" with an unpredictable random value.

Although they remain constant within an individual Python process, they are

not predictable between repeated invocations of Python.

This is intended to provide protection against a denial-of-service caused by

carefully-chosen inputs that exploit the worst case performance of a dict

insertion, O(n^2) complexity. See

http://www.ocert.org/advisories/ocert-2011-003.html for details.

Changing hash values affects the order in which keys are retrieved from a

dict. Although Python has never made guarantees about this ordering (and it

typically varies between 32-bit and 64-bit builds), enough real-world code

implicitly relies on this non-guaranteed behavior that the randomization is

disabled by default.

See also :envvar:`PYTHONHASHSEED`.

.. versionadded:: 2.6.8

.. envvar:: PYTHONHASHSEED

If this variable is set to ``random``, the effect is the same as specifying

the :option:`-R` option: a random value is used to seed the hashes of str,

bytes and datetime objects.

If :envvar:`PYTHONHASHSEED` is set to an integer value, it is used as a

fixed seed for generating the hash() of the types covered by the hash

randomization.

Its purpose is to allow repeatable hashing, such as for selftests for the

interpreter itself, or to allow a cluster of python processes to share hash

values.

The integer must be a decimal number in the range [0,4294967295].

Specifying the value 0 will lead to the same hash values as when hash

randomization is disabled.

.. versionadded:: 2.6.8

typedef struct {

long prefix;

long suffix;

} _Py_HashSecret_t;

PyAPI_DATA(_Py_HashSecret_t) _Py_HashSecret;

PyAPI_DATA(int) Py_HashRandomizationFlag;

PyAPI_FUNC(int) _PyOS_URandom (void *buffer, Py_ssize_t size);

def test_hash_randomization(self):

# Verify that -R enables hash randomization:

self.verify_valid_flag('-R')

hashes = []

for i in range(2):

code = 'print(hash("spam"))'

data = self.start_python('-R', '-c', code)

hashes.append(data)

self.assertNotEqual(hashes[0], hashes[1])

# Verify that sys.flags contains hash_randomization

code = 'import sys; print sys.flags'

data = self.start_python('-R', '-c', code)

self.assertTrue('hash_randomization=1' in data)

import os

import sys

import struct

import datetime

import subprocess

IS_64BIT = (struct.calcsize('l') == 8)

class HashRandomizationTests(unittest.TestCase):

# Each subclass should define a field "repr_", containing the repr() of

# an object to be tested

def get_hash_command(self, repr_):

return 'print(hash(%s))' % repr_

def get_hash(self, repr_, seed=None):

env = os.environ.copy()

if seed is not None:

env['PYTHONHASHSEED'] = str(seed)

else:

env.pop('PYTHONHASHSEED', None)

cmd_line = [sys.executable, '-c', self.get_hash_command(repr_)]

p = subprocess.Popen(cmd_line, stdin=subprocess.PIPE,

stdout=subprocess.PIPE, stderr=subprocess.STDOUT,

env=env)

out, err = p.communicate()

out = test_support.strip_python_stderr(out)

return int(out.strip())

def test_randomized_hash(self):

# two runs should return different hashes

run1 = self.get_hash(self.repr_, seed='random')

run2 = self.get_hash(self.repr_, seed='random')

self.assertNotEqual(run1, run2)

class StringlikeHashRandomizationTests(HashRandomizationTests):

def test_null_hash(self):

# PYTHONHASHSEED=0 disables the randomized hash

if IS_64BIT:

known_hash_of_obj = 1453079729188098211

else:

known_hash_of_obj = -1600925533

# Randomization is disabled by default:

self.assertEqual(self.get_hash(self.repr_), known_hash_of_obj)

# It can also be disabled by setting the seed to 0:

self.assertEqual(self.get_hash(self.repr_, seed=0), known_hash_of_obj)

def test_fixed_hash(self):

# test a fixed seed for the randomized hash

# Note that all types share the same values:

if IS_64BIT:

h = -4410911502303878509

else:

h = -206076799

self.assertEqual(self.get_hash(self.repr_, seed=42), h)

class StrHashRandomizationTests(StringlikeHashRandomizationTests):

repr_ = repr('abc')

def test_empty_string(self):

self.assertEqual(hash(""), 0)

class UnicodeHashRandomizationTests(StringlikeHashRandomizationTests):

repr_ = repr(u'abc')

def test_empty_string(self):

self.assertEqual(hash(u""), 0)

class BufferHashRandomizationTests(StringlikeHashRandomizationTests):

repr_ = 'buffer("abc")'

def test_empty_string(self):

self.assertEqual(hash(buffer("")), 0)

class DatetimeTests(HashRandomizationTests):

def get_hash_command(self, repr_):

return 'import datetime; print(hash(%s))' % repr_

class DatetimeDateTests(DatetimeTests):

repr_ = repr(datetime.date(1066, 10, 14))

class DatetimeDatetimeTests(DatetimeTests):

repr_ = repr(datetime.datetime(1, 2, 3, 4, 5, 6, 7))

class DatetimeTimeTests(DatetimeTests):

repr_ = repr(datetime.time(0))

HashBuiltinsTestCase,

StrHashRandomizationTests,

UnicodeHashRandomizationTests,

BufferHashRandomizationTests,

DatetimeDateTests,

DatetimeDatetimeTests,

DatetimeTimeTests)

self.assertEqual(len(os.urandom(0.9)), 0)

self.assertEqual(len(os.urandom(1.1)), 1)

self.assertEqual(len(os.urandom(2.0)), 2)

def test_urandom_length(self):

self.assertEqual(len(os.urandom(0)), 0)

self.assertEqual(len(os.urandom(1)), 1)

self.assertEqual(len(os.urandom(10)), 10)

self.assertEqual(len(os.urandom(100)), 100)

self.assertEqual(len(os.urandom(1000)), 1000)

def test_urandom_value(self):

data1 = os.urandom(16)

data2 = os.urandom(16)

self.assertNotEqual(data1, data2)

def get_urandom_subprocess(self, count):

code = '\n'.join((

'import os, sys',

'data = os.urandom(%s)' % count,

'sys.stdout.write(data)',

'sys.stdout.flush()'))

cmd_line = [sys.executable, '-c', code]

p = subprocess.Popen(cmd_line, stdin=subprocess.PIPE,

stdout=subprocess.PIPE, stderr=subprocess.STDOUT)

out, err = p.communicate()

out = test_support.strip_python_stderr(out)

self.assertEqual(len(out), count)

return out

def test_urandom_subprocess(self):

data1 = self.get_urandom_subprocess(16)

data2 = self.get_urandom_subprocess(16)

self.assertNotEqual(data1, data2)

>>>>>>> other