Re: [BUG] unsafe metatable paradigm

[Roberto Ierusalimschy <roberto@...>]

> So, why is the standard IO library not sandbox-friendly (in the strict
> sense clarified above) out of the box? Is it going to lose any (intended,
> since we are sticking with it) functionality by being sandbox-friendly? Is
> it because it is (too) hard to make it so? Perhaps we might think of a
> mechanism to make this straightforward?

do
  local io = require 'io'
  local mt = getmetatable(io.stdin)
  mt.__metatable = "not your business"
end

Problem solved? Too hard?


> Or at least explain the tradeoffs somewhere?

Cons - we lose the flexibility to add new metamethods to files (no big deal);
Pros - we satisfy some nitpicking (as big a deal as desired).

-- Roberto