Skip to content

fix: eliminate Redis TOCTOU race on step cache ops - #81

Open
VedantMadane wants to merge 1 commit into
bug0inc:mainfrom
VedantMadane:fix/redis-toctou-race-71
Open

fix: eliminate Redis TOCTOU race on step cache ops#81
VedantMadane wants to merge 1 commit into
bug0inc:mainfrom
VedantMadane:fix/redis-toctou-race-71

Conversation

@VedantMadane

Copy link
Copy Markdown

Summary

Fixes a classic TOCTOU race between Redis null-checks and later hgetall/hset/expire calls (#71).

Holding a getRedis() reference across await boundaries is unsafe: resetRedis() (e.g. test teardown) or a mid-run disconnect can leave a dangling client that throws and crashes step execution.

Changes

  • Add non-throwing helpers in src/redis.ts: redisHGetAll, redisHSet, redisExpire
    • Re-resolve the client at call time (no long-lived reference)
    • Catch connection/command errors and degrade (empty cache / skip write) instead of throwing
  • Use helpers from runSteps step-cache paths and from data-cache global/project Redis ops
  • resetRedis() now nulls the module reference before disconnect()
  • Unit tests for success, failure, unconfigured, and mid-flight reset paths
  • CHANGELOG.md entry under [Unreleased] / Fixed

Test plan

  • pnpm run build (tsc clean)
  • vitest: redis.test.ts, data-cache.test.ts, integration/run-steps.test.ts (36 passed)

Fixes #71

Signed-off-by: Vedant Madane 6527493+VedantMadane@users.noreply.github.com

Re-resolve the Redis client at each cache call and wrap hgetall/hset/expire
in non-throwing helpers so disconnect or resetRedis() between a null-check
and use cannot crash step execution.

Fixes bug0inc#71

Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Race condition between Redis null-check and hgetall call

1 participant