Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Secure key #67

Merged
merged 3 commits into from
Mar 22, 2021
Merged

Secure key #67

merged 3 commits into from
Mar 22, 2021

Commits on Mar 15, 2021

  1. Cryptographically sign and verify redis key

    The current implementation contains two potential security
    vulnerabilities. The Redis key assigned by Redbird could be manipulated
    to potentially access other data in Redis and assign it as part of the
    user's session information. Values stored in Redis are also being
    deserialized using an Erlang function that can execute functions stored
    as values.
    
    This change closes those potential security vulnerabilities by
    cryptographically signing the Redis key used by Redbird and by using a
    deserialization function that safely handles Erlang terms including
    functions. When a user places a key-value in Redis via Redbird, Redbird
    generates a key, signs it, and optionally prepends the namespace. When
    accessing the key from Redis, Redbird verifies the key, rejects keys
    that have been tampered with, and safely deserializes the stored Erlang
    terms. Likewise, Redbird only permits deletion of keys that are valid.
    lancejjohnson committed Mar 15, 2021
    Configuration menu
    Copy the full SHA
    7d269eb View commit details
    Browse the repository at this point in the history

Commits on Mar 19, 2021

  1. Configuration menu
    Copy the full SHA
    80ddd8c View commit details
    Browse the repository at this point in the history
  2. Introduce Value module

    Introduce a Value module that handles the serialization and
    deserialization of the value store in Redis by Redbird.
    lancejjohnson committed Mar 19, 2021
    Configuration menu
    Copy the full SHA
    11f54ec View commit details
    Browse the repository at this point in the history