etternagame/etterna

Run Lua scripts in a sandbox

Closed this issue · 2 comments

We dont properly do this at the moment and grant access to dangerous libraries as a result.

Relevant code area (the visible code would give a blank environment but is never used):

if (blank_env) {
lua_newtable(L);
lua_setfenv(L, lua_gettop(L) - Args - 1);

not sandboxing, but this should resolve most of the concerns about unsafe functions being available: 093834e

reopen if desired but the security problems should be mostly if not entirely gone