Home GnuPG

Remove SHA1 file content hashing and make Files work without any hashing
440ef5b7a7e4Unpublished

Unpublished Commit ยท Learn More

Repository Importing: This repository is still importing.

Description

Remove SHA1 file content hashing and make Files work without any hashing

Summary:
Ref T12464. We currently use SHA1 to detect when two files have the same content so we don't have to store two copies of the data.

Now that a SHA1 collision is known, this is theoretically dangerous. T12464 describes the shape of a possible attack.

Before replacing this with something more robust, shore things up so things work correctly if we don't hash at all. This mechanism is entirely optional; it only helps us store less data if some files are duplicates.

(This mechanism is also less important now than it once was, before we added temporary files.)

Test Plan: Uploaded multiple identical files, saw the uploads work and the files store separate copies of the same data.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T12464

Differential Revision: https://secure.phabricator.com/D17619

Details

Provenance
epriestley <git@epriestley.com>Authored on Apr 4 2017, 11:49 PM
Parents
rPHAB1e181f0781ca: Deprecate "file.uploadhash"
Branches
Unknown
Tags
Unknown

Event Timeline