archer884 / harsh

Hashids implementation in Rust
Apache License 2.0
63 stars 4 forks source link

Do not decode invalid hashids #18

Closed archer884 closed 4 years ago

archer884 commented 4 years ago

As demonstrated by @sam701 in #17, it is possible to cause harsh to decode a hashid that had been modified with additional characters. Because harsh does not perform the re-encoding process common to many other implementations of hashids, harsh fails to detect that the input hashid is not of a form that would be created by any hashids implementation and, therefore, the resulting output is invalidated.

This PR causes harsh to reject such modified hashids by performing that (relatively expensive) re-encoding process.

Closes #17