lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

I'm just writing out a few values into a lua file that returns a table when i
call dofile on it. So... return {{some table params}} ... One of the params is a file path. I have a little process that grabs each of these little .lua files, loads it up, reads the params and does it thing accordingly. However, I can definitely see the security problems with that as well. I'll have to lock that down a bit at the end of it all.

Quoting HyperHacker <>:

On Tue, Jun 15, 2010 at 20:00, Alex Queiroz <> wrote:

On Tue, Jun 15, 2010 at 10:57 PM,  <> wrote:
I'm having a serious brain fart here.. I start off with a string that holds
a file path, something like aFilePath = "c:\\a\\b\\c\\d\\filename.blah.. As
I pass it around in Lua, it removes the \ and becomes C:\a\b\c.. and so on.. Now I save the filepath to a file, it gets saved as C:\a\b\c\d etc.. without
the added \\... now when i try to load up the file, I loose all \'s,
obviously because it think's these are escape sequences now... I shouldn't
have to replace these all the time with \\ ... how can I keep the file path
intact between saves and loads etc?

    You can write the string thus: aFilePath = [[c:\a\b\c\d\filename.blah]]


What are you doing that causes configuration values to be unescaped?
The only thing I can think of is making your config file a Lua script,
or injecting strings from it into loadstring()'d code. If you're not
careful, either of these can be major security issues, and if you are
doing this for a good reason, look at string.format('%q', foo).

Sent from my toaster.

This message was sent using IMP, the Internet Messaging Program.