3 ms·
I am not really talking about a language at all (at least not on a byte-alphabet). Maybe we misunderstood a bit. For example, take a look at the [new Redis 2.0
by albertzeyer 16y ago
I am not really talking about a language at all (at least not on a byte-alphabet).
Maybe we misunderstood a bit. For example, take a look at the [new Redis 2.0 protocol](http://redis.io/topics/protocol http://redis.io/topics/protocol). In this protocol, injections are simply impossible. This may not be the best example because you don't really have more complicated queries but you could just do the same for tree-like structures.
- tptacek 16y agoI think you're wrong, both in your general point and about the possibility about Redis query injection; unfortunately, you're wrong in ways I'm not at liberty to correct. I can only ask that you take my word for it that you need to be as mindful with the code that constructs Redis keys as you do with code that concatenates SQL queries. And, as with SQL, much (perhaps most) production-quality code isn't susceptible to attack; but the lines that are tend to blindside you.
- albertzeyer 16y agoNow that made me curious... Can you say when/where I could read about that?
- stephth 16y agotptacek, are you claiming you are aware of critical vulnerabilities in Redis?
- kalleboo 16y agoI don't see why you couldn't inject a CR LF? Sure it might not be that dangerous (although it could be depending on what validation the server does on # of args), but you're still modifying the query.
- albertzeyer 16y agoBecause you are sending the byte-size of the key/value. So whatever there comes, it will be covered, you can just pass any possible binary string.