Merge pull request #2350 from nextcloud/fix/url-hash-xxh128

fix: Use xxh128 for url_hash column instead of md5

Author: marcelklehr

lib/Db/BookmarkMapper.php

@@ -109,7 +109,8 @@ protected function getFindByUrlQuery(): IQueryBuilder {
 			->select('*')
 			->from('bookmarks')
 			->where($qb->expr()->eq('user_id', $qb->createParameter('user_id')))
-			->andWhere($qb->expr()->eq('url_hash', $qb->createParameter('url_hash')));
+			->andWhere($qb->expr()->eq('url_hash', $qb->createParameter('url_hash')))
+			->andWhere($qb->expr()->eq('url', $qb->createParameter('url')));
 		return $qb;
 	}
 
@@ -132,7 +133,8 @@ public function findByUrl($userId, $url): Bookmark {
 		$qb = $this->findByUrlQuery;
 		$qb->setParameters([
 			'user_id' => $userId,
-			'url_hash' => md5($url),
+			'url' => $url,
+			'url_hash' => hash('xxh128', $url),
 		]);
 		return $this->findEntity($qb);
 	}
@@ -401,7 +403,8 @@ private function _sortAndPaginate(IQueryBuilder $qb, QueryParameters $params): v
 	private function _filterUrl(IQueryBuilder $qb, QueryParameters $params): void {
 		if (($url = $params->getUrl()) !== null) {
 			$normalized = $this->urlNormalizer->normalize($url);
-			$qb->andWhere($qb->expr()->eq('b.url_hash', $qb->createPositionalParameter(md5($normalized))));
+			$qb->andWhere($qb->expr()->eq('b.url_hash', $qb->createPositionalParameter(hash('xxh128', $normalized))));
+			$qb->andWhere($qb->expr()->eq('b.url', $qb->createPositionalParameter($normalized)));
 		}
 	}
 
@@ -880,7 +883,7 @@ public function insert(Entity $entity): Bookmark {
 		if ($entity->isWebLink()) {
 			$entity->setUrl($this->urlNormalizer->normalize($entity->getUrl()));
 		}
-		$entity->setUrlHash(md5($entity->getUrl()));
+		$entity->setUrlHash(hash('xxh128', $entity->getUrl()));
 
 		if ($entity->getAdded() === null) {
 			$entity->setAdded(time());

lib/Migration/Version016002000Date20260201124723.php

@@ -69,7 +69,7 @@ public function postSchemaChange(IOutput $output, Closure $schemaClosure, array
 				$this->db->commit();
 				$this->db->beginTransaction();
 			}
-			$setQb->setParameter('url_hash', md5($row['url']));
+			$setQb->setParameter('url_hash', hash('xxh128', $row['url']));
 			$setQb->setParameter('id', $row['id']);
 			$setQb->executeStatement();
 			$output->advance();