CODEWITHSUNDEEP
ruby-on-railsredis
bukk530
bukk530

Reputation: 1895

Passing arbitrary data to rails cache

I am wondering whether is it safe or not to directly pass arbitrary data as a cache name in rails, for example:

Rail.cache.fetch(params[:unsafe_param], expires_in: 2.hours) do
    'foo'
end

I am using the redis driver, and my concerns are about any SQL-Injection like attack to the cache, is this something I have to worry about or the driver itself does the sanitization?

Upvotes: 0

Views: 190

Answers (1)

Chris
Chris

Reputation: 12181

It depends on your usecase, but the general answer is yes. That is unsafe because Redis has no concept of authentication.

Keys are just strings, so a user could iterate over tons of param values to read anything you had in Redis. Furthermore, they would also be writing values to the cache for every one of those requests, opening you up to denial of service attacks. The attack strategy would be to simply fill up all of the memory on the machine where Redis lives by requesting billions of keys. If anything else is on that machine, it would go down as well.

So validate as many things as you can and only set keys with data you have validated and know to be finite.

Upvotes: 2

Related Questions