Re: Require

[Jamie Webb <j@...>]

On Sun, Jul 25, 2004 at 03:53:05PM -0400, Diego Nehab wrote:
>     For purists, it *is* possible to prevent the global environment from
>     being visible inside the namespace, so I only see advantages.
 
It's not just about purity: there are security issues. Untrusted code
should be able to use libraries, and not be able to get at restricted
functions through the library namespace, or be able to redefine the
functions called by the library.

> The biggest challenge in the is how to map a name, such as
> "socket.http", into a function (loaded Lua chunk or a C entrypoint)
> to be called. There doesn't appear to be a way to make everyone happy.
> I believe the best way to do it is to provide some standard that works
> for mainstream OSs (those that have directories, at least) *and*
> provide an easy way to override the mapping function, preserving the rest
> of the functionality.

Presumably there will be a global table of mappings, which may be created in
advance from C, in order to deal with static libraries. If the require
function just looks in that table and expects the function to be
there, then the default filesystem-based loader could be the __index
metamethod for that table.

Anyone requiring different functionality could replace __index, either
retaining the default to make a chain, or replacing it entirely. That
would mean exposing a primitive_require or something, which would take
a loaded chunk and do the trickery necessary to turn it into a
namespace-constructor.

-- Jamie Webb