lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

I just tried using this:

secureenviron = {
  getfenv = function(...)
    return _G.getfenv(...)
  --... other lua functions
for _,v in pairs(secureenviron) do
  if type(v) == "function" then setfenv(v, secureenviron) end

This protects against: getfenv(getfenv) to get ahold of the global
table, I have no idea how to prevent climbing the stack levels to get
at the global environment other than raising an error. Doing simple
checks to see if the table returned by getfenv() is the global table
seems prone to errors (and attack).

-Patrick Donnelly

"One of the lessons of history is that nothing is often a good thing
to do and always a clever thing to say."

-Will Durant