From 19268f0eba830b499c202fd7a9676522c53c29c3 Mon Sep 17 00:00:00 2001
From: Marcel Klehr <mklehr@gmx.net>
Date: Thu, 12 Feb 2026 17:40:03 +0100
Subject: [PATCH] fix: Use xxh128 for url_hash column instead of md5

Signed-off-by: Marcel Klehr <mklehr@gmx.net>
---
 lib/Db/BookmarkMapper.php                            | 11 +++++++----
 lib/Migration/Version016002000Date20260201124723.php |  2 +-
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/Db/BookmarkMapper.php b/lib/Db/BookmarkMapper.php
index d309804ad..6a49d99c6 100644
--- a/lib/Db/BookmarkMapper.php
+++ b/lib/Db/BookmarkMapper.php
@@ -109,7 +109,8 @@ protected function getFindByUrlQuery(): IQueryBuilder {
 			->select('*')
 			->from('bookmarks')
 			->where($qb->expr()->eq('user_id', $qb->createParameter('user_id')))
-			->andWhere($qb->expr()->eq('url_hash', $qb->createParameter('url_hash')));
+			->andWhere($qb->expr()->eq('url_hash', $qb->createParameter('url_hash')))
+			->andWhere($qb->expr()->eq('url', $qb->createParameter('url')));
 		return $qb;
 	}
 
@@ -132,7 +133,8 @@ public function findByUrl($userId, $url): Bookmark {
 		$qb = $this->findByUrlQuery;
 		$qb->setParameters([
 			'user_id' => $userId,
-			'url_hash' => md5($url),
+			'url' => $url,
+			'url_hash' => hash('xxh128', $url),
 		]);
 		return $this->findEntity($qb);
 	}
@@ -401,7 +403,8 @@ private function _sortAndPaginate(IQueryBuilder $qb, QueryParameters $params): v
 	private function _filterUrl(IQueryBuilder $qb, QueryParameters $params): void {
 		if (($url = $params->getUrl()) !== null) {
 			$normalized = $this->urlNormalizer->normalize($url);
-			$qb->andWhere($qb->expr()->eq('b.url_hash', $qb->createPositionalParameter(md5($normalized))));
+			$qb->andWhere($qb->expr()->eq('b.url_hash', $qb->createPositionalParameter(hash('xxh128', $normalized))));
+			$qb->andWhere($qb->expr()->eq('b.url', $qb->createPositionalParameter($normalized)));
 		}
 	}
 
@@ -880,7 +883,7 @@ public function insert(Entity $entity): Bookmark {
 		if ($entity->isWebLink()) {
 			$entity->setUrl($this->urlNormalizer->normalize($entity->getUrl()));
 		}
-		$entity->setUrlHash(md5($entity->getUrl()));
+		$entity->setUrlHash(hash('xxh128', $entity->getUrl()));
 
 		if ($entity->getAdded() === null) {
 			$entity->setAdded(time());
diff --git a/lib/Migration/Version016002000Date20260201124723.php b/lib/Migration/Version016002000Date20260201124723.php
index 9a70b4634..39ca19afc 100644
--- a/lib/Migration/Version016002000Date20260201124723.php
+++ b/lib/Migration/Version016002000Date20260201124723.php
@@ -69,7 +69,7 @@ public function postSchemaChange(IOutput $output, Closure $schemaClosure, array
 				$this->db->commit();
 				$this->db->beginTransaction();
 			}
-			$setQb->setParameter('url_hash', md5($row['url']));
+			$setQb->setParameter('url_hash', hash('xxh128', $row['url']));
 			$setQb->setParameter('id', $row['id']);
 			$setQb->executeStatement();
 			$output->advance();