lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

>> With sandboxing, you can start from [2]. Most difficult things are
>> isolating 'string' metatable (otherwise its members are available
>> through any string variable) and prevention of DoS attacks (like
>> `while true do end`, which can bypass `debug.sethook` on some Lua
>> implementations).
> I'd be surprised if "while true do end" can break debug hooks,

Please try this code under Lua and LuaJIT:

$ cat dos.lua
    print 'hook'
end, "", 1e3)
while true do end

$ lua dos.lua

$ luajit dos.lua
<prints nothing>

> since
> it's not making any C calls. Any time you make a C function available
> though (such as string.rep) you have to watch out that the user can't
> abuse it to overwhelm your app, e.g. with string.rep("a", 99999999) or
> ("a"):rep(9999):rep(9999):rep(9999):rep(9999)...

This is another problem...


Best regards,
Boris Nagaev