lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]


I guess loadstring() would use the _ENV in the lexical scope of its call site?

If so, I guess our code that runs a user-provided string in a
not-very-strong-sandbox change from:

function new(grammar_string)
    local fenv = setmetatable({
        -- Provide empty versions of modules that should not be used:
        debug = {}, -- etc...
        -- Provide erroring versions of functions that should not be used:
        dofile = disallow"dofile", -- etc...
    }, {
        __index = _G
    })
    local grammar_fn = assert(loadstring(grammar_string, "Grammar"))
    setfenv(grammar_fn, fenv)
    grammar_fn()
end

would become:

function new(grammar_string)
    local _ENV = setmetatable({
        -- Provide empty versions of modules that should not be used:
        debug = {}, -- etc...
        -- Provide erroring versions of functions that should not be used:
        dofile = disallow"dofile", -- etc...
    }, {
        __index = _ENV
    })
    local grammar_fn = assert(loadstring(grammar_string, "Grammar"))
    grammar_fn()
end

Cheers,
Sam