Re: Reducing Lua's Trusted Computing Base

["Stuart P. Bentley" <stuart@...>]

On Tue, 27 Jul 2010 19:46:12 -0400, Luiz Henrique de Figueiredo  
<lhf@tecgraf.puc-rio.br> wrote:

> Bottom line: accept Lua plugins and servelets in text form only and  
> sandbox
> whatever is needed.

Reminder to force load() to load text in the same low-privilege sandbox as  
the servlet. You don't want to create a hole by letting functions do  
whatever they want as long as they wrap it in a load[==[...]==]!