2 Commits

Author SHA1 Message Date
322d71f0be refactor!: remove MinimumLoad() option (#17)
All checks were successful
CI / Check PR Title (push) Has been skipped
CI / Go Lint (push) Successful in 38s
CI / Makefile Lint (push) Successful in 36s
CI / Markdown Lint (push) Successful in 21s
CI / Unit Tests (push) Successful in 37s
CI / Fuzz Tests (push) Successful in 1m9s
CI / Mutation Tests (push) Successful in 1m18s
## Description

The `cuckoo.MinimumLoad()` option was not a very useful option, and prone to error. By removing the ability to modify it, and setting it to something reasonable (like 5%), we can remove a whole set of errors that the user may stumble into.

## Changes

- Remove `MinimumLoad()` option.
- Privated `DefaultMinimumLoad`.

### Design Decisions

- `DefaultMinimumLoad` should be privated because it is no longer an option. The user should not need to interact with it.

## Checklist

- [x] Tests pass
- [x] Docs updated

Reviewed-on: #17
2026-04-03 14:51:41 +00:00
ed30a4fc7c fix: check-pr-title job has prompt injection (#18)
All checks were successful
CI / Check PR Title (push) Has been skipped
CI / Go Lint (push) Successful in 36s
CI / Makefile Lint (push) Successful in 35s
CI / Markdown Lint (push) Successful in 22s
CI / Unit Tests (push) Successful in 35s
CI / Fuzz Tests (push) Successful in 1m6s
CI / Mutation Tests (push) Successful in 1m10s
## Description

Currently, the `check-pr-title` job has a security vulnerability. If you give the PR a bad title, the job can run arbitrary code.

## Changes

- Fix prompt injection by pulling the PR title as an environment variable.
- Also, restricted the job to only `pull_request` trigger.

### Design Decisions

- It is better to pull out this job into a separate workflow with a unique trigger, but I chose not to because it is currently only one job.

## Checklist

- [x] Tests pass
- [x] Docs updated

Reviewed-on: #18
Co-authored-by: M.V. Hutz <git@maximhutz.me>
Co-committed-by: M.V. Hutz <git@maximhutz.me>
2026-04-03 14:47:01 +00:00
4 changed files with 10 additions and 30 deletions

View File

@@ -9,9 +9,11 @@ jobs:
check-pr-title:
name: Check PR Title
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
env:
TITLE: ${{ gitea.event.pull_request.title }}
steps:
- run: |
TITLE="${{ gitea.event.pull_request.title }}"
if ! echo "$TITLE" | grep -qE '^(WIP: )?(feat|fix|docs|chore|ci|test|refactor|perf|build|style|revert)(\(.+\))?(!)?: .+'; then
echo "::error::Pull Request title must follow conventional commits"
exit 1

View File

@@ -3,7 +3,6 @@ package cuckoo_test
import (
"fmt"
"maps"
"math"
"os"
"testing"
@@ -30,7 +29,6 @@ type fuzzStep struct {
type fuzzScenario struct {
seedA, seedB uint32
capacity, growthFactor uint8
load float64
steps []fuzzStep
}
@@ -48,7 +46,6 @@ func FuzzInsertLookup(f *testing.F) {
seedA, seedB := scenario.seedA, scenario.seedB
growthFactor := max(2, int(scenario.growthFactor))
capacity := int(scenario.capacity)
minimumLoad := math.Abs(math.Mod(scenario.load, 1.0))
// If they are the same number, the hashes will clash, always causing an
// error.
@@ -56,14 +53,8 @@ func FuzzInsertLookup(f *testing.F) {
t.Skip()
}
// If the load is too high, the hashs will not be able to allocate
// properly.
if minimumLoad > 0.20 {
t.Skip()
}
fmt.Fprintf(os.Stderr, "seedA=%d seedB=%d capacity=%d growthFactor=%d minimumLoad=%f\n",
seedA, seedB, capacity, growthFactor, minimumLoad)
fmt.Fprintf(os.Stderr, "seedA=%d seedB=%d capacity=%d growthFactor=%d\n",
seedA, seedB, capacity, growthFactor)
actual := cuckoo.NewCustomTable[uint32, uint32](
offsetHash(seedA),
@@ -71,7 +62,6 @@ func FuzzInsertLookup(f *testing.F) {
func(a, b uint32) bool { return a == b },
cuckoo.Capacity(capacity),
cuckoo.GrowthFactor(growthFactor),
cuckoo.MinimumLoad(minimumLoad),
)
expected := map[uint32]uint32{}

View File

@@ -12,11 +12,12 @@ const DefaultCapacity uint64 = 16
// hash table implementations use 2.
const DefaultGrowthFactor uint64 = 2
// DefaultMinimumLoad is the default lowest acceptable occupancy of a [Table].
// The value of 5% is taken from [libcuckoo].
// defaultMinimumLoad is the default lowest acceptable occupancy of a [Table].
// The higher the minimum load, the more likely that a [Table.Put] will not
// succeed. The value of 5% is taken from [libcuckoo].
//
// [libcuckoo]: https://github.com/efficient/libcuckoo/blob/656714705a055df2b7a605eb3c71586d9da1e119/libcuckoo/cuckoohash_config.hh#L21
const DefaultMinimumLoad float64 = 0.05
const defaultMinimumLoad float64 = 0.05
type settings struct {
growthFactor uint64
@@ -38,19 +39,6 @@ func Capacity(value int) Option {
return func(s *settings) { s.bucketSize = uint64(value) }
}
// MinimumLoad modifies the [DefaultMinimumLoad] of the [Table]. The value must
// be between 0.00 and 1.00.
//
// The higher the minimum load, the more likely that a [Table.Put] will not
// succeed. Minimum loads above 20% are not tested.
func MinimumLoad(value float64) Option {
if value < 0.00 || value > 1.00 {
panic(fmt.Sprintf("go-cuckoo: MinimumLoad must be between 0.00 and 1.00, got %f", value))
}
return func(s *settings) { s.minLoadFactor = value }
}
// GrowthFactor controls how much the capacity of the [Table] multiplies when
// it must resize. The value must be greater than 1.
func GrowthFactor(value int) Option {

View File

@@ -198,7 +198,7 @@ func NewCustomTable[K, V any](hashA, hashB Hash[K], compare EqualFunc[K], option
settings := &settings{
growthFactor: DefaultGrowthFactor,
bucketSize: DefaultCapacity,
minLoadFactor: DefaultMinimumLoad,
minLoadFactor: defaultMinimumLoad,
}
for _, option := range options {