Re: metatables for strings?

[Rena <hyperhacker@...>]

On Sun, May 3, 2015 at 1:40 PM, Nagaev Boris <bnagaev@gmail.com> wrote:
> On Sun, May 3, 2015 at 5:06 PM, Dirk Laurie <dirk.laurie@gmail.com> wrote:
>> 2015-05-03 18:40 GMT+02:00 Nagaev Boris <bnagaev@gmail.com>:
>>> On Sun, May 3, 2015 at 4:35 PM, Dirk Laurie <dirk.laurie@gmail.com> wrote:
>>>>
>>>> You can put a function in the "string" table and it will immediately
>>>> be callable with object-oriented syntax on a string object just like
>>>> str:format etc. Since the first argument is provided, that function
>>>> can itself pick out a submethod from a table of functions.
>>>>
>>>
>>> Changing global metatable of all strings does not sound good. If all
>>> strings had same methods, then methods added to UrlString, would also
>>> be available to normal strings. It is confusing and it breaks idea of
>>> sandboxes, because sandboxed code can apply UrlString's methods to
>>> malicious strings.
>>
>> If the methods were all provided by the sandbox author, who presumably
>> knows what he is doing, I don't see the problem.
>>
>
> Can a sandbox isolate added string's methods? Can you provide
> sandboxing function passing this test:
>
> string.hack = function() print("Hacked") end
> code = [[ ("just string"):hack() ]]
> sandbox(code)
>
>
> --
>
>
> Best regards,
> Boris Nagaev
>

function sandbox(code)
    dostring("string.hack = nil; " .. code)
end

But seriously, if you're worried about that kind of abuse, your
sandbox should be replacing the loaded function's "string" table with
a known-safe one.

-- 
Sent from my Game Boy.