5 ms·
I would like to note that libmemcached does expose key validation as a behavior. It’s off by default though, which I think it probably should not be. However I’
by toxik 6y ago
I would like to note that libmemcached does expose key validation as a behavior. It’s off by default though, which I think it probably should not be. However I’m not sure about the performance impact in typical workloads — some people make quite large gets.
- danpalmer 6y agoInteresting, I hadn't seen that, updated. I don't think `pylibmc` exposes it, or again not by default. I actually don't think that it's wrong for a driver library to have these sorts of features disabled by default, because the target audience is typically a slightly higher level of abstraction rather than the end-developer. I think the aim should be to mimic the API of the service as closely as possible with the same defaults where possible. It's then the responsibility of the abstraction layer closer to the application to decide what's more appropriate on that end, and for that to be resolved between the two.
- toxik 6y agoI think Django should set the behavior by default. It is exposed by pylibmc. I know because I wrote it.
- danpalmer 6y agoYep I agree. That's pretty much what the vulnerability was about! (Although Django decided to implement the check itself as it can be therefore be implemented in the same way for all Memcached backends)