go-redis Client for Redis operations. Most Redis commands are typed and safe, but Eval() and EvalSha() accept Lua scripts that can be injection sinks when the script body is user-controlled. ACL commands can also be sinks.
.Get().Eval().EvalSha().ScriptLoad().Do().Get()SourceGet(ctx context.Context, key string) *StringCmd
Fetches a string value. Source when cached data originated from user input.
return.Eval()SinkEval(ctx context.Context, script string, keys []string, args ...any) *Cmd
Executes a Lua script on the Redis server. Injection sink if script is user-controlled.
1.EvalSha()SinkEvalSha(ctx context.Context, sha1 string, keys []string, args ...any) *Cmd
Executes a cached Lua script by SHA. Less risky than Eval but tainted SHA can still trigger unintended scripts.
1.ScriptLoad()SinkScriptLoad(ctx context.Context, script string) *StringCmd
Registers a Lua script for later EvalSha. Sink when script is user-controlled.
1.Do()SinkDo(ctx context.Context, args ...any) *Cmd
Sends an arbitrary command. Command-injection sink when the command name is user-controlled.
1.Set()NeutralSet(ctx context.Context, key string, value any, expiration time.Duration) *StatusCmd
Stores a value. Typed and generally safe.
| FQN | Field | |
|---|---|---|
| github.com/redis/go-redis/v9.Client | fqns[0] | |
| *.Client | patterns |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
require github.com/redis/go-redis/v9 v9.5.1
from codepathfinder.go_rule import GoRedisClient