[severe security issue] player can cause lua to run arbitrary code because of unprotected loadstring call
Closed this issue · 1 comments
SumianVoice commented
https://github.com/Bituvo/digilines_fpu/blob/main/init.lua#L3
This allows the user to run any code, since loadstring will run any lua sent to it, meaning you could shut down the server or ban everyone, delete the world etc.
Bituvo commented
This if statement only calls loadstring
if the expression contains digits, operators, or parentheses. You cannot use it with letters. Therefore, it is safe from the dreaded sandbox escape.