mirror of
https://github.com/projectdiscovery/nuclei.git
synced 2026-11-11 12:11:40 -10:00
Mzack9999
2710ba232b
* improving lua script with args and values * fixing comments * keys to string * fixing context * fix(test): drop log() calls inflating redis-lua-script result count The two log() calls each emitted a [JS] stdout line that the integration harness counted as a result, yielding 3 results vs the expected 1. The matcher reads `response` from the final expression value (not stdout), so returning the get RunLuaScript call directly keeps the assertion intact with a single result. * fix flaky * harden sdk tests Avoid shared templates-dir update races across parallel go test packages and ignore known leveldb/ratelimit/memguardian goroutines in goleak. * fix sdk templates Keep goleak ignores, drop DisableUpdateCheck so CI can install templates, and serialize UpdateIfOutdated across processes.
30 lines
1.0 KiB
YAML
30 lines
1.0 KiB
YAML
id: redis-lua-script
|
|
|
|
info:
|
|
name: Redis RunLuaScript - Detect
|
|
author: DhiyaneshDK
|
|
severity: info
|
|
|
|
javascript:
|
|
- code: |
|
|
const redis = require('nuclei/redis');
|
|
// Set a key via KEYS with a string and a numeric arg via ARGV: validates
|
|
// that keys are passed through and non-string args are not dropped
|
|
redis.RunLuaScript(Host, Port, Password, 'return redis.call("set", KEYS[1], ARGV[1] .. ":" .. ARGV[2])', ['testkey'], ['testvalue', 123]);
|
|
|
|
// Read the value back via KEYS and return it as the response so the
|
|
// matcher can assert the combined string was stored correctly
|
|
redis.RunLuaScript(Host, Port, Password, 'return redis.call("get", KEYS[1])', ['testkey'], []);
|
|
|
|
args:
|
|
Host: "{{Host}}"
|
|
Port: "6379"
|
|
# must match the --requirepass value of the dockerized redis instance
|
|
# started by internal/tests/integration/javascript_test.go
|
|
Password: "iamadmin"
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'success == true && contains(response, "testvalue:123")'
|