lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

In Scribunto (using Lua 5.1 in a very strict secure mode), I just get:

arg="foo" (function(...) print(arg) end)(1)
--> table
--> table: 0x....
The internal pointer (or any unique identifier of the function or debugging info) is concealed: with tostring(function()end), we just know the type='function' and nothing else (we can't even get the function's environment or get a function name).

The only available feature is calling debug.traceback (where all tracing info coming from outside the public modules loaded by Scribunto are hidden, instead we get the internal name of the accessible modules or exported function names, and line numbers in the modules themselves; we never have any info from the C runtime, we just know that there's some C function used at the bottom of the traced call stack, and tracing stops there; in addition, calling debug.traceback() generates an error that terminates the script and clears all existing outputs)

That version 5.1 exposes limited capabilities, but Lua 5.1 is not so "obsolete" (because it is supported specifically but only for these restricted and secured capabilities), it is still used on a VERY LARGE scale; it is the most widely used version, running for hundreds of sites (possibly more), totaling billions of active visitors (most Internet users of the world) and indirectly accessible via bots indexing their contents to present it on search engines or third party sites.

That version 5.1, whose documentation is maintained and published along with the documentation of Scribunto itself (including the description of the very few supported libraries, and their modifications or additions) has support for "..." but still exposes the implicitly declared "arg" local variable in function bodies (which hides any external variable of the same name).

Lua 5.2, 5.3 or 5.4 are still not supported (for now), their security and stability has not been deeply evaluated, or there's a compatibility issue to port it for its safe integration in a securely restricted PHP environment.

Le jeu. 9 sept. 2021 à 13:11, Andrew Gierth <> a écrit :
>>>>> "Philippe" == Philippe Verdy <> writes:

 Philippe> This is quoted from Lua 5.2

No it's not, it's from _section 5.2_ of the book about Lua 5.0.

 Philippe> And this is the only text available on official site

It is the only text _of the book_ there, because the updated editions of
the book cost actual money to buy.

The reference documentation for 5.2 which can be found at covers this issue under "function

 Philippe> Version 5.2 really had the implicitly declared local variable
 Philippe> "arg",

5.0 had that, 5.1 deprecated it in favour of ..., and 5.2 removed it.
This is trivially verified by experiment:

$ lua51 -e 'arg="foo" (function(...) print(arg) end)(1)'
table: 0x...........

$ lua52 -e 'arg="foo" (function(...) print(arg) end)(1)'