Re: Sandboxing scripts, luaL_openlibs, and require

[Patrick Donnelly <batrick@...>]

On Sun, May 17, 2009 at 12:39 PM, Patrick Donnelly <batrick@batbytes.com> wrote:
> You may find it easier to simply delete the _LOADED table from the
> registry and then call luaL_openlibs for each thread. This will cause
> each function to be remade and each thread environment to have a
> unique library instantiation. This example function (untested) should
> work well enough:
>
> void open_lua_libraries (lua_State *L, lua_State *thread)
> {
>  lua_getfield(L, LUA_REGISTRYINDEX, "_LOADED"); /* current _LOADED
> table created in main state */
>  lua_pushnil(L);
>  lua_setfield(L, LUA_REGISTRYINDEX, "_LOADED"); /* delete the _LOADED table */
>  luaL_openlibs(thread); /* open libraries, creates new _LOADED table */
>  lua_setfield(L, LUA_REGISTRYINDEX, "_LOADED"); /* replace our
> original _LOADED table */
> }

I should add that this trick does not protect you from functions that
use the registry for some purpose. The package library (including the
require and module functions) utilizes the Lua registry. The debug
library also allows direct access to the registry. You must decide
what you want each thread's sandbox to contain.

-- 
-Patrick Donnelly

"Let all men know thee, but no man know thee thoroughly: Men freely
ford that see the shallows."

- Benjamin Franklin