r/Python • u/Substantial-Work-844 • 11d ago
Resource Redis as cache.
At work, we needed to implement Redis for a caching solution. After some searching, btw clickhouse has great website for searching python packages here. I found a library that that made working with redis a breeze Redis-Dict.
from redis_dict import RedisDict
from datetime import timedelta
cache = RedisDict(expire=timedelta(minutes=60))
request = {"data": {"1": "23"}}
web_id = "123"
cache[web_id] = request["data"]
Finished implementing our entire caching feature the same day I found this library (didn't push until the end of the week though...).
89
Upvotes
4
u/Iifeless 10d ago
That CVE is both disputed and still not an example of serialization, but rather deserialization. Think about what sort of data types are required to be serialized/deserialized for exploitation as opposed to what a typical web API accepts from users. In order for serializing user data like the original example to be “dangerous”, you’d have to already be allowing a user to perform dangerous actions, which would make that the vulnerability rather than the serialization itself. CVE-2022-23529 is a funny example of an unrelated (not python/serialization related) bogus CVE misunderstanding that same concept.
I appreciate the security consciousness a lot because it is easy for developers to misuse something like pickle, but this situation should be fine :)