fix(scripting): sanitize lua error replies (#3494)

fix #3493


Lua's error return poses an injection risk; see issues for details.

I used codex gpt-5.5 to fix it.

Author: jihuayu

src/storage/scripting.cc

@@ -60,6 +60,16 @@ enum {
 
 namespace lua {
 
+namespace {
+
+std::string SanitizeErrorMessage(std::string_view message) {
+  std::string sanitized(message);
+  std::erase_if(sanitized, [](char c) { return c == '\r' || c == '\n'; });
+  return sanitized;
+}
+
+}  // namespace
+
 lua_State *CreateState() {
   lua_State *lua = lua_open();
   LoadLibraries(lua);
@@ -1295,7 +1305,7 @@ std::string ReplyToRedisReply(redis::Connection *conn, lua_State *lua) {
       lua_rawget(lua, -2);
       t = lua_type(lua, -1);
       if (t == LUA_TSTRING) {
-        output = redis::Error({Status::RedisErrorNoPrefix, lua_tostring(lua, -1)});
+        output = redis::Error({Status::RedisErrorNoPrefix, SanitizeErrorMessage(lua_tostring(lua, -1))});
         lua_pop(lua, 1);
         return output;
       }

tests/gocase/unit/scripting/scripting_test.go

@@ -90,6 +90,17 @@ func TestScripting(t *testing.T) {
 		require.Nil(t, r.Val())
 	})
 
+	t.Run("EVAL - Lua error reply strips embedded CRLF", func(t *testing.T) {
+		c := srv.NewTCPClient()
+		defer func() { require.NoError(t, c.Close()) }()
+
+		require.NoError(t, c.WriteArgs("EVAL", "return redis.error_reply('ERR injected\\r\\n+INJECTED\\r\\n')", "0"))
+		c.MustRead(t, "-ERR injected+INJECTED")
+
+		require.NoError(t, c.WriteArgs("PING"))
+		c.MustRead(t, "+PONG")
+	})
+
 	t.Run("Script return recursive object", func(t *testing.T) {
 		c := srv.NewTCPClient()
 		defer func() { require.NoError(t, c.Close()) }()