2

I'm working with a modding api for a game, for those curious it's factorio but it's not really relevant, and the Lua environment is HEAVILY limited, blocking functions like setfenv, it's a 5.1 environment and I do have access to loadstring, pcall, etc. My question is how would you recommend running 'unsafe' code that is provided by a user and limiting what functions they can access without access to environment modification functions? (Preferably whitelist functions/values instead of blacklist, but I'll take whatever I can get)

Nicholas Scott
  • 21
  • 2
  • If you're willing to heavily sacrifice performance, there are several Lua-in-Lua emulators available. (http://lua-users.org/wiki/LuaInterpreterInLua) – Stormswept Jun 05 '17 at 20:31

2 Answers2

4

In Lua 5.1 you need setfenv to create a secure sandbox (see this answer for a typical procedure). So if you don't have access to setfenv, then I don't think it can't be done.

Then again, if the environment you're working in has disabled setfenv and has put a wrapper around loadstring to avoid malicious bytecode loading (again, see the answer I linked) then you might be able to run the script without setting up a special environment for it. It really depends on the details of your current environment as to whether it's safe or not.

Jack Taylor
  • 5,588
  • 19
  • 35
0

I apologize for a late answer (you've probably moved on by now) but it is possible to do this using the built in load function. You can supply a fourth argument to the function which is a custom environment and it returns a function. You can pass a function, a string, or possibly even a thread (I think) to load and get the result you want. I was also having this problem and I thought I'd answer it for future users.

Here is a link to the documentation on the lua site for load: https://www.lua.org/manual/5.2/manual.html#pdf-load I have tested this to ensure it works properly in Factorio and it appears to work as intended.

Hexcede
  • 131
  • 8