Re: sandboxing security, lua bytecode, metatables and string library

[Mildred <ml.mildred593@...>]

I just think it is the same problem with function environments. If lua
bytecode can access function environments, then it have access to
string.gsub environment that is the global environemnt.
That's even worse. Direct access to dangerous functions.

has the bytecode access to those metadata (metatable and environment) ?
if so, is there any way to secure a sandbox ?

Well, you can forbid bytecode (for example I'm thinking of adding extra
spaces in the loaded file) but that means you can't provide functions
like load() or so.

Mildred

-- 
Mildred       <xmpp:mildred@jabber.fr> <http://mildred632.free.fr/>
Clef GPG :    <hkp://pgp.mit.edu> ou <http://mildred632.free.fr/gpg_key>
Fingerprint : 197C A7E6 645B 4299 6D37 684B 6F9D A8D6 [9A7D 2E2B]