lua-l archive

Search lua-l

This index contains 143,615 documents and 1,774,615 keywords. Last update on 2023-03-09 .

81. Re: Sandbox implementation (score: 2)

Author: David F <kumpuu@...>

Date: Sun, 26 Mar 2017 04:09:33 +0200

Hello, thanks for the insight As I said, preventing crashes or freezes are not my objective. While they suck, they don't do any major damage compared to a virus. Host api is rather small but certainl

82. Re: Sandbox implementation (score: 2)

Author: Frank Kastenholz <fkastenholz@...>

Date: Mon, 20 Mar 2017 08:06:54 -0500 (CDT)

Hi I've built Lua sandboxes there are a couple of other things to consider besides filesystem, i/o and the various os library functions 1 memory use. you want to ensure that the thing running in the

83. Re: Sandbox implementation, attempt #2 (score: 2)

Author: Kat Kioo <meepdarknessmeep@...>

Date: Sat, 18 Mar 2017 21:27:26 -0400

Let me recap to see if I understand you correctly. Your concept is basically: -Generate a key the first time my extension runs on a users PC -When running a new mod, compile it to bytecode and sign

84. Sandbox implementation, attempt #2 (score: 2)

Author: "David F" <kumpuu@...>

Date: Sun, 19 Mar 2017 02:24:24 +0100

Let me recap to see if I understand you correctly. Your concept is basically: -Generate a key the first time my extension runs on a users PC -When running a new mod, compile it to bytecode and sign i

85. Re: Sandbox implementation, attempt #2 (score: 2)

Author: "Soni L." <fakedme@...>

Date: Sat, 18 Mar 2017 19:47:06 -0300

The problem is, sandboxing has many pitfalls, and I'm really new to lua. So I would really appreciate if anyone could take a look at my code and tell me if there is anything wrong with it. Don't want

86. Sandbox implementation, attempt #2 (score: 2)

Author: "David F" <kumpuu@...>

Date: Sat, 18 Mar 2017 23:26:43 +0100

Hello, Sorry, I forgot to turn off HTML in my previous posting. I'm currently adding lua (5.1/luajit) to a game (the stock modding system they provide is really crappy). Now I don't want any modders

87. Sandbox implementation (score: 2)

Author: "Anon ym" <kumpuu@...>

Date: Sat, 18 Mar 2017 23:09:45 +0100

Hello, I'm currently adding lua (5.1/luajit) to a game (the stock modding system they provide is really crappy). Now I don't want any modders to mess peoples PC's up, that's why I decided it needs a

88. Re: Restricted parsing for static config files / more granular `load()` options for 5.4 (score: 3)

Author: Jamie Jennings <jj27700@...>

Date: Mon, 13 Mar 2017 09:51:05 -0400

Both can be limited with debug.sethook.  To get compute-limited sandboxing, you need pre-emption.  Your choices are either debug.sethook or modification of the Lua interpreter. A nice examination of

89. Re: Restricted parsing for static config files / more granular `load()` options for 5.4 (score: 2)

Author: nobody <nobody+lua-list@...>

Date: Mon, 13 Mar 2017 12:19:19 +0100

Both can be limited with debug.sethook. A while ago I wrote something that (I think) catches everything that's relevant. Code is below, longer explanation is at <http://stackoverflow.com/a/41945465/8

90. Re: Restricted parsing for static config files / more granular `load()` options for 5.4 (score: 2)

Author: Martin <eden_martin_fuhrspam@...>

Date: Mon, 13 Mar 2017 00:44:05 -0700

It is possible to have infinitely running code without recursions. It's because code can create new functions and call them. Here is an example: local create_func = function(body) return function() r

91. Re: Restricted parsing for static config files / more granular `load()` options for 5.4 (score: 2)

Author: "Soni L." <fakedme@...>

Date: Sun, 12 Mar 2017 16:33:21 -0300

The biggest problem that simple _ENV sandboxing can't avoid is infinitely long running code, one would need either the debug library to block a script after N instructions or use their own parser. In

92. Restricted parsing for static config files / more granular `load()` options for 5.4 (score: 2)

Author: Rain Gloom <raingloom42@...>

Date: Sun, 12 Mar 2017 19:16:52 +0000

TLDR: just like we can disable bytecode loading, we should be able to disable certain language constructs, creating fully sandboxed configs The biggest problem that simple _ENV sandboxing can't avoid

93. Re: Does Lua need a JIT? (score: 2)

Author: Ahmed Charles <acharles@...>

Date: Wed, 1 Mar 2017 08:54:24 +0000

Disclaimer: My preferred languages are either C++ or Rust for heavy lifting and Lua for scripting (though, I don't script very often). If one takes a step back and thinks about why people use JIT for

94. Re: Make "package.loaded" weak (score: 2)

Author: William Ahern <william@...>

Date: Tue, 21 Feb 2017 16:59:38 -0800

IIRC, the problem with cqueues that you ran into before was that some cqueues Lua script modules interpose C-based methods to provide enhanced behavior (particularly yielding for Lua 5.1). That inter

95. Re: Lua and backwards compatibility - was Re: [ANN] Lua 5.3.4 (rc2) now available, (score: 4)

Author: William Ahern <william@...>

Date: Thu, 12 Jan 2017 23:21:15 -0800

Right, but it was a huge break from 4.0. The big break in the 5.x family is _ENV, and the related removal of module and function environments. Most changes in 5.2 and 5.3 are feature additions that h

96. Some thoughts on security (score: 2)

Author: Samuel Groß <mail@...>

Date: Mon, 12 Dec 2016 00:21:33 +0100

Hi! I was playing around with Lua a bit lately and noticed that it supported loading precompiled bytecode at runtime through `load` [1], which caught my attention. Looking at the source code, it seem

97. Re: ActiveState seeking Lua community feedback (score: 2)

Author: Eric Wing <ewmailing@...>

Date: Tue, 15 Nov 2016 14:19:55 -0800

Hi Bulat, Thank you for your response. Yes, I have seen Dear ImGUI. I'm actually using a similar one called Nuklear for several projects. (You can briefly see an elaborate GUI in the project I show a

98. Re: [ANN] Rembulan, an implementation of Lua 5.3 for the JVM (score: 2)

Author: Miroslav Janí?ek <mira.janicek@...>

Date: Thu, 6 Oct 2016 22:37:43 +0200

True: if more than one state is needed, LuaJava is preferable. M.

99. Re: [ANN] Rembulan, an implementation of Lua 5.3 for the JVM (score: 2)

Author: "Soni L." <fakedme@...>

Date: Thu, 6 Oct 2016 11:21:21 -0300

I have used both LuaJava and LuaJ as recently as last year. Source-compatibility (or at least a compatibility layer) would be welcome. I have got a rudimentary version of LuaJava?s Lua API (i.e., the

100. Re: Sandboxing a module that clutters the global environment (score: 33)

Author: alloyed@...

Date: Wed, 05 Oct 2016 17:38:52 -0700

Hi *, I have a 3rd party module that operates and maintains its state in the global environment. Is there anyway I can load this module into a custom context table, so that it uses that table as its