|
Am 07.04.2014 07:51 schröbte steve donovan:
On Mon, Apr 7, 2014 at 3:35 AM, Thiago L. <fakedme@gmail.com> wrote:I keep arguing with sandbox writers that debug.getmetatable should be allowed in sandboxes, even if limited to be unable to get the metatable of specific objects (from a blacklist table or something probably).They would probably argue that if that functionality was needed, then you could provide a function to do it within the sandbox. Since we don't use package.loadall, seems safe and convenient enough.
Since many objects share a common metatable, a per-object blacklist doesn't make sense. A per-metatable blacklist would be better. I'd probably implement that using a designated field in the metatables ... wait ... never mind ...
Philipp