vuejs / component-compiler-utils

Lower level utilities for compiling Vue single file components
319 stars 75 forks source link

Hash collision with `hash-sum` package #132

Open kentahama opened 1 year ago

kentahama commented 1 year ago

Version

3.3.0

Explanation

I have found two different files that has the same hash value on following lines:

https://github.com/vuejs/component-compiler-utils/blob/27e4fa359d77d28b73a66089ce781e0a03962277/lib/parse.ts#L55-L57

As a result, parse returns wrong cache for these files, which can cause builds to fail randomly or produce unexpected results. As mentioned in https://github.com/bevacqua/hash-sum/issues/4, hash-sum algorithm is not suitable for content hashing. Unfortunately, I cannot share these private files here, but this issue may arise in projects with more than 10,000 files. Would it be possible to switch to a more promising hash function, such as xxhash?

Related issue

https://github.com/vitejs/vite/issues/912