This document describes the security measures built into oxcache, the threat models they mitigate, and the process for reporting security vulnerabilities.

oxcache provides a defense-in-depth security layer for Redis-backed caching. All security functions are gated behind the redis feature and are automatically enforced by the RedisBackend. They can also be called directly from application code for custom validation scenarios.

By default, oxcache requires TLS-encrypted Redis connections (rediss:// scheme). Non-TLS connections (redis://) are rejected at backend construction time with a clear error message.

Non-TLS connections are allowed only when the environment variable OXCACHE_ALLOW_INSECURE_REDIS is explicitly set to one of:

• I_UNDERSTAND_THE_RISKS
• development-only

# Development only — never use in production
export OXCACHE_ALLOW_INSECURE_REDIS=I_UNDERSTAND_THE_RISKS

Warning: Setting this variable in production exposes Redis traffic (including credentials) to network interception. The application log will record a warning when this bypass is active.

Function: oxcache::validate_redis_key(key: &str) -> Result<()>

Validates Redis keys before they are sent to the server, preventing command injection and malformed key attacks.

use oxcache::validate_redis_key;

validate_redis_key("user:123")?;           // OK
validate_redis_key("user\r\nSET foo bar")?; // Err — CRLF injection detected
validate_redis_key("")?;                    // Err — empty key

Function: oxcache::validate_lua_script(script: &str, key_count: usize) -> Result<()>

Validates Lua scripts before EVAL/EVALSHA execution, preventing server-side resource exhaustion and dangerous command execution.

The validator preprocesses the script to strip comments, string literals, and long-bracket content before pattern matching, preventing evasion via string obfuscation.

use oxcache::validate_lua_script;

// Safe script
validate_lua_script("return redis.call('GET', KEYS[1])", 1)?;

// Rejected — FLUSHALL is forbidden
validate_lua_script("redis.call('FLUSHALL')", 0)?;

// Rejected — too many keys
validate_lua_script("return 1", 101)?;

Function: oxcache::validate_scan_pattern(pattern: &str) -> Result<()> Function: oxcache::clamp_scan_count(count: usize) -> usize

Validates SCAN patterns and clamps COUNT to prevent Redis server overload.

use oxcache::{validate_scan_pattern, clamp_scan_count};

validate_scan_pattern("user:*")?;              // OK
validate_scan_pattern("*:*:*:*:*:*:*:*:*:*:*")?; // Err — too many wildcards

let count = clamp_scan_count(1_000_000);       // Returns 10_000

Function: RedisBackend::redact_connection_string(conn_str: &str) -> String Function: oxcache::redact_value(value: &str, visible_chars: usize) -> String Function: oxcache::redact_cache_key(key: &str) -> String Function: oxcache::redact_field(field_name: &str, value: &str) -> String

These functions ensure credentials and sensitive data never appear in logs or error messages.

use oxcache::backend::memory::redis::RedisBackend;

let conn_str = "redis://:secret_password@localhost:6379/0";
let redacted = RedisBackend::redact_connection_string(conn_str);
// redacted == "redis://[REDACTED]@localhost:6379/0"
assert!(!redacted.contains("secret_password"));

Function: oxcache::log_cache_key(key: &str) -> String Function: oxcache::sanitize_message(msg: &str) -> String

These utilities ensure cache keys and log messages are sanitized before being written to logs, preventing log injection attacks.

If you discover a security vulnerability in oxcache:

1. Do NOT open a public GitHub issue.
2. Email the maintainer at the address listed in the Cargo.toml authors field.
3. Include:
   • A description of the vulnerability
   • Steps to reproduce (proof of concept)
   • Affected versions
   • Suggested fix (if any)
4. You will receive an acknowledgment within 48 hours.
5. A fix will be developed and released following responsible disclosure timelines.

Only the latest minor release receives security updates. When a new minor version is released, the previous minor version receives critical fixes for 30 days only.