According to the Redis documentation [1], "The sandbox attempts to prevent accidental misuse [...] Scripts should never [...] attempt to perform any other system call other than those supported by the API".
(Also "reduce potential threats", but that doesn't sound like the primary purpose or a particularly strong claim of security.)
But does "it won't work" mean "don't try this in your app" or does it mean that the system can be expected to safely run arbitrary untrusted code?
The documentation makes it sound like it's primarily intended to guide people towards using the API correctly. Here is the whole section for context:
Redis places the engine that executes user scripts inside a sandbox. The sandbox attempts to prevent accidental misuse and reduce potential threats from the server's environment.
Scripts should never try to access the Redis server's underlying host systems, such as the file system, network, or attempt to perform any other system call other than those supported by the API.
Scripts should operate solely on data stored in Redis and data provided as arguments to their execution.
Comments
Is this sandbox intended as a security feature?
According to the Redis documentation [1], "The sandbox attempts to prevent accidental misuse [...] Scripts should never [...] attempt to perform any other system call other than those supported by the API".
(Also "reduce potential threats", but that doesn't sound like the primary purpose or a particularly strong claim of security.)
[1] https://redis.io/topics/programmability
That's what I'm wondering, too, right now.
It's trivial to DoS-hang redis with the script feature (and SCRIPT KILL won't help).
And I found at least 3 DoS-crash, because it hasn't backported fixes to its copy of Lua 5.1.5 (but Debian's liblua 5.1 might -- I haven't checked).
And that's without even exploring the really problematic builtins it still has available.
Maybe they should instead clarify their security guarantee for redis scripting (e.g. "none").
I think your edits are mangling the intended meaning of the quote. Your script should not try to perform other system calls, because it won't work.
But does "it won't work" mean "don't try this in your app" or does it mean that the system can be expected to safely run arbitrary untrusted code?
The documentation makes it sound like it's primarily intended to guide people towards using the API correctly. Here is the whole section for context: