0

I'm thinking of letting users share their own built Lua scripts through my server. However I am concerned for client side exploits caused by the Lua scripts. To my understanding, Lua is built to prevent this. However I've seen some Lua exploits. Should I maybe seek another way, with a sandbox maybe?

My framework is built on Qt and I was thinking of using QtLua.

RBerteig
  • 41,948
  • 7
  • 88
  • 128
RobotRock
  • 4,211
  • 6
  • 46
  • 86
  • What do you mean by *sharing*? – lhf Apr 04 '12 at 16:04
  • Sharing, exchanging. They can make LUA scripts and let others execute them. – RobotRock Apr 04 '12 at 17:15
  • If you execute scripts in separate states, one for each run, there is not much problem, except avoiding consuming resources such as time and memory. – lhf Apr 04 '12 at 18:08
  • 1
    There are already questions about secure Lua sandboxes: http://stackoverflow.com/questions/1224708/how-can-i-create-a-secure-lua-sandbox http://stackoverflow.com/questions/7857101/lua-sandbox-with-special-functions-which-leak http://stackoverflow.com/questions/325323/is-there-anyway-to-avoid-this-security-issue-in-lua Maybe those can help you. –  Apr 04 '12 at 18:32

1 Answers1

2

Sandbox your script execution and make sure to forbid the loading and execution of pre-compiled bytecode on both the client and server sides. In your sand boxes, make sure to us a "white list" technique to provide only vetted and known safe (in your context) operations to the user scripts.

You might want to run scripts in a separate process (or thread) and use platform services to limit the amount of CPU time and memory a script is allowed to consume, otherwise a user who is tricked into running the script repeat until false will consume an entire CPU core and there are similarly simple attacks on memory.

Whether this is a concern is more of a perception issue IMHO, as the possibility of a simple denial of service attack on an individual's personal machine is not in the same league as enabling an exploit that results in theft of passwords or banking details.

RBerteig
  • 41,948
  • 7
  • 88
  • 128