• meir's avatar
    Move user eval function to be located on Lua registry. · 992f9e23
    meir authored
    Today, Redis wrap the user Lua code with a Lua function.
    For example, assuming the user code is:
    
    ```
    return redis.call('ping')
    ```
    
    The actual code that would have sent to the Lua interpreter was:
    
    ```
    f_b3a02c833904802db9c34a3cf1292eee3246df3c() return redis.call('ping') end
    ```
    
    The wraped code would have been saved on the global dictionary with the
    following name: `f_<script sha>` (in our example `f_b3a02c833904802db9c34a3cf1292eee3246df3c`).
    
    This approach allows one user to easily override the implementation a another user code, example:
    
    ```
    f_b3a02c833904802db9c34a3cf1292eee3246df3c = function() return 'hacked' end
    ```
    
    Running the above code will cause `evalsha b3a02c833904802db9c34a3cf1292eee3246df3c 0` to return
    hacked although it should have returned `pong`.
    
    Another disadventage is that Redis basically runs code on the loading (compiling) phase without been
    aware of it. User can do code injection like this:
    
    ```
    return 1 end <run code on compling phase> function() return 1
    ```
    
    The wraped code will look like this and the entire `<run code on compling phase>` block will run outside
    of eval or evalsha context:
    
    ```
    f_<sha>() return 1 end <run code on compling phase> function() return 1 end
    ```
    992f9e23
eval.c 58.6 KB