3 ms·
Non existing problem with Redis (not possible at protocol level), for what it is worth.
by antirez 16y ago
Non existing problem with Redis (not possible at protocol level), for what it is worth.
- mrkurt 16y agoIt's not exactly a protocol issue for mongo, though. If it weren't for Rails/PHP (and more) converting magical strings into objects of another type, it wouldn't be possible in Mongo either. This would be the equivalent of some helper wrapper on top of a redis driver that turned strings with a special format into, say, an MGET command that returned more than a developer meant for it to. redis is safer because it doesn't have the complex query-over-document functionality that mongo does, but it's not inherently immune.
- antirez 16y agoThe new Redis protocol (the only one used at this point) is inherently immune, with SORT we have complex queries. But the point is, the way we send every different argument to the server as a single entity with prefixed length, makes the attack impossible.
- albertzeyer 16y agoThe old Redis protocol was also not binary safe. If you are able to access the value in some `redisCommand("SET %s %s", key, value)`, you are able to inject other commands there. But the new Redis protocol is safe against that.