lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]


Hi!

As Lua 5.2 and Lua 5.3 manuals say, "Maliciously crafted binary chunks can crash the interpreter".
That's why additional argument was introduced in load() and loadfile():
mode = "b" / "t" / "bt"
But why we do not have the same argument in require() ?
Maliciously crafted "crash.luac" file can be renamed to "some_module.lua", and the interpreter will crash on require("some_module")
If it can be considered as security hole, we definitely need an option to disable loading bytecode files in require()

-- Egor