Comment Comment by mikemike That's what I'm wondering, too, right now.It's trivial to DoS-hang redis with the script feature (and SCRIPT KILL won't help).And I found at least 3 DoS-crash, because it hasn't backported fixes to its copy of Lua 5.1.5 (but Debian's liblua 5.1 might -- I haven't checked).And that's without even exploring the really problematic builtins it still has available.Maybe they should instead clarify their security guarantee for redis scripting (e.g. "none"). parent mikemike 4 years ago
It's trivial to DoS-hang redis with the script feature (and SCRIPT KILL won't help).
And I found at least 3 DoS-crash, because it hasn't backported fixes to its copy of Lua 5.1.5 (but Debian's liblua 5.1 might -- I haven't checked).
And that's without even exploring the really problematic builtins it still has available.
Maybe they should instead clarify their security guarantee for redis scripting (e.g. "none").