rules-redis

ADVISORY: Redis EVAL runs arbitrary Lua on the server. Ensure the script is a fixed literal (not constructed from user input), review it for logic errors, and consider using EVALSHA with pre-loaded scripts to reduce attack surface.

RISK: Redis EVAL with string interpolation can inject arbitrary Lua code, allowing data exfiltration or server-side RCE (CWE-94). FIX: never embed user-supplied values in the Lua script — pass them as KEYS[] or ARGV[] arguments to a fixed, pre-reviewed script.

RISK: FLUSHALL deletes every key in every Redis database — it is irreversible and catastrophic in production. FIX: restrict this command to maintenance scripts with explicit operator confirmation, never call it from application code, and use ACL SETUSER to deny FLUSHALL for the application user.

RISK: FLUSHDB deletes all keys in the current Redis database without confirmation. FIX: gate behind explicit operator confirmation in maintenance scripts only; never call from application code.

RISK: hardcoded Redis connection string with embedded password leaks credentials when committed. FIX: load from an environment variable (process.env.REDIS_URL / os.environ['REDIS_URL']) and never commit the literal value.

RISK: KEYS * (or KEYS '*') does a full keyspace scan and blocks the Redis event loop for the entire duration — in production this can cause connection timeouts for all clients. FIX: use SCAN with a cursor and a COUNT hint to iterate the keyspace incrementally.