Re: Using Lua for config files

[Enrico Colombini <erix@...>]

On 19/12/2013 2.59, Luiz Henrique de Figueiredo wrote:
> But unfortunately one can still write anonymous functions
> and then write full-blown Lua programs inside them:
>
> {
> 	malice = (function () while true do end end)()
> }
>
> Now if you can patch your Lua lexer to avoid the keyword "function", then
> you're ok. One simple way is to change "function" to "function " (note the
> space). You can also clear the "reserved" flag for the string "function"
> just before loading the config file.

Without patching the lexer, at a small performance cost, the program 
could just raise an error if the script contains the string "function".
Unless the script is compiled, in which case the check would have to be 
done at bytecode level.

(or am I missing something?)

--
  Enrico