Fix options handling bug in Hash validator preventing the use of non-default algorithms

psalm-baseline.xml

@@ -3377,6 +3377,7 @@
       <code><![CDATA[getHash]]></code>
       <code><![CDATA[getHash]]></code>
       <code><![CDATA[getHash]]></code>
+      <code><![CDATA[getOptions]]></code>
       <code><![CDATA[setHash]]></code>
     </DeprecatedMethod>
     <MixedArgument>
@@ -3393,6 +3394,7 @@
       <code><![CDATA[basicBehaviorDataProvider]]></code>
       <code><![CDATA[hashProvider]]></code>
       <code><![CDATA[invalidHashTypes]]></code>
+      <code><![CDATA[optionsOrderProvider]]></code>
     </PossiblyUnusedMethod>
   </file>
   <file src="test/File/ImageSizeTest.php">

src/File/Hash.php

@@ -69,6 +69,12 @@ public function __construct($options = null)
             $options['algorithm'] = func_get_arg(1);
         }
 
+        // The combination of parent and local logic requires us to have the "algorithm" key before the "hash" key
+        // in the array, or else the default algorithm will be used instead of the passed one.
+        if (isset($options['algorithm'])) {
+            $options = ['algorithm' => $options['algorithm']] + $options;
+        }
+
         parent::__construct($options);
     }
 

test/File/HashTest.php

@@ -4,6 +4,7 @@
 
 namespace LaminasTest\Validator\File;
 
+use Generator;
 use Laminas\Validator\Exception\InvalidArgumentException;
 use Laminas\Validator\File\Hash;
 use PHPUnit\Framework\Attributes\DataProvider;
@@ -15,6 +16,7 @@
 use function basename;
 use function current;
 use function is_array;
+use function key;
 use function sprintf;
 
 use const UPLOAD_ERR_NO_FILE;
@@ -313,4 +315,52 @@ public function testHashMustMatchWithTheAlgorithm(): void
 
         self::assertFalse($validator->isValid(__DIR__ . '/_files/crc32-int.pdf'));
     }
+
+    /**
+     * Provides options that should result in the same result irrespective of key order
+     *
+     * In order to act as a regression test for issue 398, this needs to include at least
+     * one couple of permutations that does not use the default algorithm (crc32).
+     *
+     * @return Generator<non-empty-string, array{
+     *     options: array<string, mixed>,
+     *     expectedHash: array<string, mixed>,
+     * }>
+     */
+    public static function optionsOrderProvider(): Generator
+    {
+        $algos  = ['crc32', 'md5', 'sha1'];
+        $hashes = [
+            'crc32' => ['6507f172bceb9ed0cc59246d41569c4d' => 'crc32'],
+            'md5'   => ['6507f172bceb9ed0cc59246d41569c4d' => 'md5'],
+            'sha1'  => ['6507f172bceb9ed0cc59246d41569c4d' => 'sha1'],
+        ];
+
+        foreach ($algos as $algo) {
+            $hash = key($hashes[$algo]);
+            yield $algo . ' algorithm first' => [
+                'options'      => [
+                    'algorithm' => $algo,
+                    'hash'      => $hash,
+                ],
+                'expectedHash' => $hashes[$algo],
+            ];
+            yield $algo . ' hash first'      => [
+                'options'      => [
+                    'hash'      => $hash,
+                    'algorithm' => $algo,
+                ],
+                'expectedHash' => $hashes[$algo],
+            ];
+        }
+    }
+
+    #[DataProvider('optionsOrderProvider')]
+    public function testOptionsKeyOrderIsIrrelevant(array $options, array $expectedHash): void
+    {
+        $validator     = new Hash($options);
+        $resultOptions = $validator->getOptions();
+        self::assertArrayHasKey('hash', $resultOptions);
+        self::assertSame($expectedHash, $resultOptions['hash']);
+    }
 }