3 ms·
It's not exactly a protocol issue for mongo, though. If it weren't for Rails/PHP (and more) converting magical strings into objects of another type, it wouldn't
by mrkurt 16y ago
It's not exactly a protocol issue for mongo, though. If it weren't for Rails/PHP (and more) converting magical strings into objects of another type, it wouldn't be possible in Mongo either.
This would be the equivalent of some helper wrapper on top of a redis driver that turned strings with a special format into, say, an MGET command that returned more than a developer meant for it to.
redis is safer because it doesn't have the complex query-over-document functionality that mongo does, but it's not inherently immune.
- antirez 16y agoThe new Redis protocol (the only one used at this point) is inherently immune, with SORT we have complex queries. But the point is, the way we send every different argument to the server as a single entity with prefixed length, makes the attack impossible.