{"record":{"id":"2a760bf8768c031c","repo":"instructure/canvas-lms","slug":"redis-method-command-is-potentially-dangerous-and-should","errorCode":null,"errorMessage":"Redis method `#{command}` is potentially dangerous, and should only be called from console, and only if you fully understand the consequences. If you're sure, retry after wrapping in `RedisClient.with_dangerous_redis_methods`","messagePattern":"Redis method `#(.+?)` is potentially dangerous, and should only be called from console, and only if you fully understand the consequences\\. If you're sure, retry after wrapping in `RedisClient\\.with_dangerous_redis_methods`","errorType":"exception","errorClass":"CanvasCache::Redis::UnsupportedRedisMethod","httpStatus":null,"severity":"error","filePath":"gems/canvas_cache/lib/redis_client/twemproxy.rb","lineNumber":107,"sourceCode":"    def call(command, _config)\n      check_command(command.first.to_s)\n      super\n    end\n\n    def call_pipelined(commands, _config)\n      commands.each do |command|\n        check_command(command.first.to_s)\n      end\n      super\n    end\n\n    def check_command(command)\n      if UNSUPPORTED_METHODS.include?(command)\n        raise CanvasCache::Redis::UnsupportedRedisMethod,\n              \"Redis method `#{command}` is not supported by Twemproxy, and so shouldn't be used in Canvas\"\n      end\n      if ALLOWED_UNSUPPORTED.include?(command) && !RedisClient.dangerous_redis_methods_allowed? && GuardRail.environment != :deploy\n        raise CanvasCache::Redis::UnsupportedRedisMethod,\n              \"Redis method `#{command}` is potentially dangerous, and should only be called from console, and only if you fully understand the consequences. If you're sure, retry after wrapping in `RedisClient.with_dangerous_redis_methods`\"\n      end\n    end\n  end\nend\n","sourceCodeStart":89,"sourceCodeEnd":113,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/gems/canvas_cache/lib/redis_client/twemproxy.rb#L89-L113","documentation":"The Twemproxy adapter allows certain risky commands (ALLOWED_UNSUPPORTED) only when explicitly opted in. If the command is in ALLOWED_UNSUPPORTED but RedisClient.dangerous_redis_methods_allowed? is false and GuardRail.environment is not :deploy, check_command raises UnsupportedRedisMethod telling you to wrap the call in RedisClient.with_dangerous_redis_methods.","triggerScenarios":"Calling an allowed-but-dangerous command (e.g. FLUSHDB/FLUSHALL-style methods) outside RedisClient.with_dangerous_redis_methods and outside a :deploy GuardRail environment — typically from a console or script.","commonSituations":"Developer runs a destructive maintenance command in the Rails console against proxied Redis; a rake task performs flush/delete without the dangerous-methods wrapper; environment detection misconfigures GuardRail so the deploy exception doesn't apply.","solutions":["Wrap the call: RedisClient.with_dangerous_redis_methods { redis.flushdb }","Run the command with GuardRail.activate(:deploy) { ... } in a controlled deploy context","Replace the destructive command with a safer, supported alternative (e.g. targeted deletes)","Move the command into a proper deploy/maintenance script that sets the right environment"],"exampleFix":"// before\nredis.flushdb\n// after\nRedisClient.with_dangerous_redis_methods do\n  redis.flushdb\nend","handlingStrategy":"try-catch","validationCode":"dangerous = ALLOWED_METHODS.include?(cmd.to_s.upcase) && !RedisClient.dangerous_redis_methods_allowed? && GuardRail.environment != :deploy","typeGuard":null,"tryCatchPattern":"begin\n  RedisClient.with_dangerous_redis_methods { redis.call(cmd) }\nrescue CanvasCache::Redis::UnsupportedRedisMethod => e\n  Rails.logger.error(\"dangerous redis call blocked: #{e.message}\")\nend","preventionTips":["Always wrap risky commands in RedisClient.with_dangerous_redis_methods","Restrict destructive Redis work to :deploy GuardRail environment","Prefer targeted deletes over FLUSH-style commands"],"tags":["redis","twemproxy","dangerous-command"],"backgroundTag":"operation-not-supported","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}