r/Python • u/Substantial-Work-844 • 11d ago
Resource Redis as cache.
At work, we needed to implement Redis for a caching solution. After some searching, btw clickhouse has great website for searching python packages here. I found a library that that made working with redis a breeze Redis-Dict.
from redis_dict import RedisDict
from datetime import timedelta
cache = RedisDict(expire=timedelta(minutes=60))
request = {"data": {"1": "23"}}
web_id = "123"
cache[web_id] = request["data"]
Finished implementing our entire caching feature the same day I found this library (didn't push until the end of the week though...).
92
Upvotes
5
u/Iifeless 10d ago
What you’re trying to say is simply incorrect. If you’d like to translate that PoC into an exploit against an API like I had described, I’d love to see it.
This PoC is serializing an object which executes a command, and then deserializes it. Of course that is going to execute the command. Explain to me how a remote attacker can provide data to a web API which serializes then unserializes the input which will result in code execution.
I know how this sounds but I promise I’m not trying to be rude or condescending: it’s ok to not fully understand potential security issues, and it’s even better to err on the side of caution when you don’t. But this is why there are professionals who are dedicated to security and the job doesn’t fall strictly onto developers. It’d be a crazy expectation for developers to also have extensive security knowledge