lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]


On 19/12/2013 2.59, Luiz Henrique de Figueiredo wrote:
But unfortunately one can still write anonymous functions
and then write full-blown Lua programs inside them:

{
	malice = (function () while true do end end)()
}

Now if you can patch your Lua lexer to avoid the keyword "function", then
you're ok. One simple way is to change "function" to "function " (note the
space). You can also clear the "reserved" flag for the string "function"
just before loading the config file.

Without patching the lexer, at a small performance cost, the program could just raise an error if the script contains the string "function". Unless the script is compiled, in which case the check would have to be done at bytecode level.

(or am I missing something?)

--
  Enrico