numberZero
/
minetest
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Block access to the `io` library

experimental
red-001 2017-01-28 21:43:06 +00:00 committed by Loic Blot
parent f8ad01ab7c
commit 2e3778ec0c
2 changed files with 13 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
builtin/common/misc_helpers.lua
View File

@ -197,6 +197,7 @@ assert(table.indexof({"foo", "bar"}, "foo") == 1)
assert(table.indexof({"foo", "bar"}, "baz") == -1)
--------------------------------------------------------------------------------
if INIT ~= "client" then
function file_exists(filename)
local f = io.open(filename, "r")
if f == nil then
@ -206,7 +207,7 @@ function file_exists(filename)
return true
end
end
end
--------------------------------------------------------------------------------
function string:trim()
return (self:gsub("^%s*(.-)%s*$", "%1"))

30
src/script/cpp_api/s_security.cpp
View File

@ -123,6 +123,7 @@ void ScriptApiSecurity::initializeSecurity()
"path",
"searchpath",
};
#if USE_LUAJIT
static const char *jit_whitelist[] = {
"arch",
"flush",
@ -134,7 +135,7 @@ void ScriptApiSecurity::initializeSecurity()
"version",
"version_num",
};
#endif
m_secure = true;
lua_State *L = getStack();
@ -245,13 +246,6 @@ void ScriptApiSecurity::initializeSecurityClient()
"table",
"math",
};
static const char *io_whitelist[] = {
"close",
"flush",
"read",
"type",
"write",
};
static const char *os_whitelist[] = {
"clock",
"date",
@ -263,6 +257,7 @@ void ScriptApiSecurity::initializeSecurityClient()
"getinfo",
};
#if USE_LUAJIT
static const char *jit_whitelist[] = {
"arch",
"flush",
@ -274,6 +269,7 @@ void ScriptApiSecurity::initializeSecurityClient()
"version",
"version_num",
};
#endif
m_secure = true;
@ -294,20 +290,6 @@ void ScriptApiSecurity::initializeSecurityClient()
lua_pop(L, 1);
// Copy safe IO functions
lua_getfield(L, old_globals, "io");
lua_newtable(L);
copy_safe(L, io_whitelist, sizeof(io_whitelist));
// And replace unsafe ones
SECURE_API(io, open);
SECURE_API(io, input);
SECURE_API(io, output);
SECURE_API(io, lines);
lua_setglobal(L, "io");
lua_pop(L, 1); // Pop old IO
// Copy safe OS functions
lua_getfield(L, old_globals, "os");
@ -324,10 +306,6 @@ void ScriptApiSecurity::initializeSecurityClient()
lua_setglobal(L, "debug");
lua_pop(L, 1); // Pop old debug
// Remove all of package
lua_newtable(L);
lua_setglobal(L, "package");
#if USE_LUAJIT
// Copy safe jit functions, if they exist
lua_getfield(L, -1, "jit");