FormWizard's hash check occasionally fails due to pickle.dumps returning varying values for same inputs

[bensonk@…]

Background: in django.contrib.formtools.utils.security_hash, the data being hashed is normalized and pickled, and an MD5 hash is taken of that data. When the next page of the wizard is submitted, the hash of the re-submitted data is checked to ensure the user did not tamper with the data.

The problem is that the security_hash function will occasionally return a different value for identical inputs. This is due to pickle.dumps (specifically the cpickle version) returning dissimilar serialized versions for the same input. This can be observed with a simple test:

from cPickle import dumps
print "equal: {}".format(str(12345) == "12345")
print "equal: {}".format(dumps(str(12345)) == dumps("12345"))

This test outputs:

equal: True
equal: False

This is not a bug in cpickle, as the pickle documentation explicitly [mentions]​http://docs.python.org/library/pickle.html#id10 that the pickle function will not necessarily return the same output for a given input.

Impact: Users who have not tampered with forms will get shunted back to a previous form page, potentially with no explanation. As a developer, this can be quite tricky to debug, and the solution in my case was to write our own hashing function that doesn't rely on pickle.

[Claude Paroz]

This is a duplicate of #18340