mirror of
https://codeberg.org/redict/redict.git
synced 2025-01-23 00:28:26 -05:00
ae2f5b7b2e
Block sensitive configs and commands by default. * `enable-protected-configs` - block modification of configs with the new `PROTECTED_CONFIG` flag. Currently we add this flag to `dbfilename`, and `dir` configs, all of which are non-mutable configs that can set a file redis will write to. * `enable-debug-command` - block the `DEBUG` command * `enable-module-command` - block the `MODULE` command These have a default value set to `no`, so that these features are not exposed by default to client connections, and can only be set by modifying the config file. Users can change each of these to either `yes` (allow all access), or `local` (allow access from local TCP connections and unix domain connections) Note that this is a **breaking change** (specifically the part about MODULE command being disabled by default). I.e. we don't consider DEBUG command being blocked as an issue (people shouldn't have been using it), and the few configs we protected are unlikely to have been set at runtime anyway. On the other hand, it's likely to assume some users who use modules, load them from the config file anyway. Note that's the whole point of this PR, for redis to be more secure by default and reduce the attack surface on innocent users, so secure defaults will necessarily mean a breaking change.
40 lines
1.0 KiB
Tcl
40 lines
1.0 KiB
Tcl
set testmodule [file normalize tests/modules/basics.so]
|
|
|
|
|
|
start_server {tags {"modules"}} {
|
|
r module load $testmodule
|
|
|
|
test {test module api basics} {
|
|
r test.basics
|
|
} {ALL TESTS PASSED}
|
|
|
|
test {test rm_call auto mode} {
|
|
r hello 2
|
|
set reply [r test.rmcallautomode]
|
|
assert_equal [lindex $reply 0] f1
|
|
assert_equal [lindex $reply 1] v1
|
|
assert_equal [lindex $reply 2] f2
|
|
assert_equal [lindex $reply 3] v2
|
|
r hello 3
|
|
set reply [r test.rmcallautomode]
|
|
assert_equal [dict get $reply f1] v1
|
|
assert_equal [dict get $reply f2] v2
|
|
}
|
|
|
|
test {test get resp} {
|
|
r hello 2
|
|
set reply [r test.getresp]
|
|
assert_equal $reply 2
|
|
r hello 3
|
|
set reply [r test.getresp]
|
|
assert_equal $reply 3
|
|
}
|
|
|
|
r module unload test
|
|
}
|
|
|
|
start_server {tags {"modules external:skip"} overrides {enable-module-command no}} {
|
|
test {module command disabled} {
|
|
assert_error "ERR*MODULE command not allowed*" {r module load $testmodule}
|
|
}
|
|
} |