Re: Question on get/setmetatable()

["Joseph C. Sible" <josephcsible@...>]

On Sat, May 23, 2020 at 2:18 PM Andrea <andrea.l.vitali@gmail.com> wrote:
>
> It seems that having set/getmetable() is the best in the end: easy to sandbox.
>

This is a pet peeve of mine: you don't ever need to restrict
setmetatable or getmetatable. You can't use setmetatable on non-tables
even with no sandboxing, and that plus using __metatable appropriately
is enough for a well-designed application to protect against all
attacks that restricting those functions could protect against, but
without giving up nearly as much useful functionality.

Joseph C. Sible