Re: Some thoughts on security

[nobody <nobody+lua-list@...>]

On 2016-12-12 01:11, Nagaev Boris wrote:
>     Beside what Daurnimator said in a parallel thread, the sentence you
>     quoted applies to Lua source code, not bytecode.
> 
>     —Pierre-Yves
> 
> Lua program can load bytecode using load function.

and os.execute "rm -rf /*" and …, so you obviously have to sandbox
anything untrusted.  Assuming you removed the debug library (and ensured
that the untrusted code can't get it back),

do
  local old_load = load
  function     load( src, src_what, _mode, env )
    return old_load( src, src_what,   "t", env )
  end
end

hard-codes the mode, forbidding binary chunks.  Without getupvalue, you
can't get it back.

-- Marco