4 ms·
The fact that it allows separate arguments should make injections vulnerabilities a lot less likely to happen by accident since there shouldn't be any need to i
by almost 15y ago
The fact that it allows separate arguments should make injections vulnerabilities a lot less likely to happen by accident since there shouldn't be any need to interpolate you arguments into the code string (this would also mess up the compiled function cache so you definitely want to do that anyway).
Also, LUA is a very small at core and I don't think it by default includes things like file system access. You pretty much just get what the host applications gives you, which in this case seems to be just the Redis API.
- antirez 15y agoThanks almost, 100% agree, just you said it in a better English :)
- LeafStorm 15y agoFirst, it's Lua. Not LUA. Secondly, it does include filesystem access by default, and right now there is no decent protection against it. Hopefully, sandboxing will be implemented before this reaches anything related to stable.
- almost 15y agoYou seem to be correct on both of those points. Sandboxing Lua does seem quite easy though: http://stackoverflow.com/questions/1224708/how-can-i-create-a-secure-lua-sandbox http://stackoverflow.com/questions/1224708/how-can-i-create-...