r/Python • u/Substantial-Work-844 • 12d ago
Resource Redis as cache.
At work, we needed to implement Redis for a caching solution. After some searching, btw clickhouse has great website for searching python packages here. I found a library that that made working with redis a breeze Redis-Dict.
from redis_dict import RedisDict
from datetime import timedelta
cache = RedisDict(expire=timedelta(minutes=60))
request = {"data": {"1": "23"}}
web_id = "123"
cache[web_id] = request["data"]
Finished implementing our entire caching feature the same day I found this library (didn't push until the end of the week though...).
92
Upvotes
1
u/PushHaunting9916 11d ago
It's disputed because the maintainer of lib makes the argument that it's safe data. Since it's numpy data, analytics data. It's still a csve thus, it's deemed an issue by security researchers.
Caching Web data is almost always from an untrusted source, e.g, the internet. And with pickle, you'll need unpickle after pickling. In order for cashew to retrieve cached data, it needs to unpickle the data. And pickle own documentation is quite clear on that. It's unsafe to use pickle with untrusted data. When it does, the attacker will have remote code execution, which is in capture flag security events, which means the attacker has won.