Re: disallow interaction with "outside world"

[Nagaev Boris <bnagaev@...>]

>>
>> With sandboxing, you can start from [2]. Most difficult things are
>> isolating 'string' metatable (otherwise its members are available
>> through any string variable) and prevention of DoS attacks (like
>> `while true do end`, which can bypass `debug.sethook` on some Lua
>> implementations).
>>
>
> I'd be surprised if "while true do end" can break debug hooks,

Please try this code under Lua and LuaJIT:

$ cat dos.lua
debug.sethook(function()
    print 'hook'
end, "", 1e3)
while true do end

$ lua dos.lua
hook
hook
hook
...

^C
$ luajit dos.lua
<prints nothing>

> since
> it's not making any C calls. Any time you make a C function available
> though (such as string.rep) you have to watch out that the user can't
> abuse it to overwhelm your app, e.g. with string.rep("a", 99999999) or
> ("a"):rep(9999):rep(9999):rep(9999):rep(9999)...

This is another problem...

-- 


Best regards,
Boris Nagaev