Re: Simple Lua for scripts

[Ben Sunshine-Hill <sneftel@...>]

On 8/22/05, Alain <alainm@pobox.com> wrote:
> He I come to explain myselt again: I don't want sandboxing. I want a
> program that allow be to test if the user is using lua functions
> *other*than*the*ones*I*allow*him*to*use* not even what most lua
> programers consider *normal* to a lua program.
> 
> For this I believe I need something called a lexical analyser, so that I
> can allow only a sunset of normal LUA syntax.
> 

This is the "impossible" static analysis I mentioned. As an example of
why this is impossible, here's a script that deletes /etc/passwd:

function dosomethingbad()
    (_G["o".."s"][table.concat { [1] = "re", [3] = "ove", [2] = "m"
}])("/etc/passwd")
end

...and does so without explicitly mentioning os.remove(). And this is
a simple example; what about a function that decrypted a PGPed script
and executed it? There just is no way to do what you want to do.
That's why sandboxing exists.

A "lexical analyzer" is a system which tokenizes input. It is
ineffective at providing security, as in the example I mentioned
above.

Ben