Hash collision security issue

Lib/test/test_hash.py

 # test the invariant that
 #   iff a==b then hash(a)==hash(b)
 #
 # Also test that hash implementations are inherited as expected
 
+import struct
 import unittest
 from test import support
+from test.script_helper import assert_python_ok
 from collections import Hashable
+
+IS_64BIT = (struct.calcsize('l') == 8)
 
 
 class HashEqualityTestCase(unittest.TestCase):
 
     def same_hash(self, *objlist):
         # Hash each object given and fail if
         # the hash values are not all the same.
         hashed = list(map(hash, objlist))
         for h in hashed[1:]:
             if h != hashed[0]:
@@ skipping 91 matching lines @@
     hashes_to_check = [range(10),
                        enumerate(range(10)),
                        iter(DefaultIterSeq()),
                        iter(lambda: 0, 0),
                       ]
 
     def test_hashes(self):
         _default_hash = object.__hash__
         for obj in self.hashes_to_check:
             self.assertEqual(hash(obj), _default_hash(obj))
+
+class RandomizationTestCase(unittest.TestCase):
+
+    # Examples of the various types having randomized hash:
+    test_reprs = [repr('abc'), repr(b'abc')]
+
+    def get_hash(self, repr_, randomization=None, seed=None):
+        env = {}
+        if randomization is not None:
+            env['PYTHONHASHRANDOMIZATION'] = str(randomization)
+        if seed is not None:
+            env['PYTHONHASHSEED'] = str(seed)
+        out = assert_python_ok(
+            '-c', 'print(hash(%s))' % repr_,
+            **env)
+        stdout = out[1].strip()
+        return int(stdout)
+
+    def test_empty_string(self):
+        self.assertEqual(hash(""), 0)
+        self.assertEqual(hash(b""), 0)
+
+    def test_null_hash(self):
+        # PYTHONHASHSEED=0 disables the randomized hash
+        if IS_64BIT:
+            known_hash_of_obj = 1453079729188098211
+        else:
+            known_hash_of_obj = -1600925533
+        for repr_ in self.test_reprs:
+            # Randomization is disabled by default:
+            self.assertEqual(self.get_hash(repr_), known_hash_of_obj)
+            
+            # If enabled, it can still be disabled by setting the seed to 0:
+            self.assertEqual(self.get_hash(repr_, randomization=1, seed=0),
+                             known_hash_of_obj)
+
+    def test_fixed_hash(self):
+        # test a fixed seed for the randomized hash
+        # Note that all types share the same values:
+        if IS_64BIT:
+            h = -4410911502303878509
+        else:
+            h = -206076799
+        for repr_ in self.test_reprs:
+            self.assertEqual(self.get_hash(repr_, randomization=1, seed=42),
+                             h)
+
+    def test_randomized_hash(self):
+        # two runs should return different hashes
+        for repr_ in self.test_reprs:
+            run1 = self.get_hash(repr_, randomization=1)
+            run2 = self.get_hash(repr_, randomization=1)
+            self.assertNotEqual(run1, run2)
+
 
 def test_main():
     support.run_unittest(HashEqualityTestCase,
                               HashInheritanceTestCase,
-                              HashBuiltinsTestCase)
+                              HashBuiltinsTestCase,
+                         RandomizationTestCase)
 
 
 if __name__ == "__main__":
     test_main()