search

davisjam / vuln-regex-detector

Detect vulnerable regexes in your project. REDOS, catastrophic backtracking.
MIT License
320 stars 29 forks source link

cache: Add in ExpirationTime to local caches. #46

Closed ewmson closed 6 years ago

ewmson commented 6 years ago

Problem: After a regex has been rescanned #45 the local client will still have the old result cached. This means a user who had previously received the result will never hit the server again and see the updated case.

Solution: Add an expiration time to the cached values that will require the server to be queried again once the time in the cache has exceeded this time. This should be configurable based on the needs of the client.

Fixes: #44

ewmson commented 6 years ago

@davisjam We should have a discussion on what we want the cache invalidation tests to look like.

One idea is to create a special directory with the invalidation tests that we clear after every cache invalidation test.

davisjam commented 6 years ago

@ewmson

We should have a discussion on what we want the cache invalidation tests to look like.

Cache invalidation -> cache expiration time?

Agreed that you shouldn't use the default persistentDir because of the risk of collisions with cached user queries that have larger expiration times. How about path.join(os.tmpdir(), 'vuln-regex-detector-TEST-cache-expiration-time')?

davisjam commented 6 years ago

@ewmson Can you update the README with the new config option?