Re: metatables for strings?
[
Date Prev][
Date Next][
Thread Prev][
Thread Next]
[
Date Index]
[
Thread Index]
- Subject: Re: metatables for strings?
- From: Dirk Laurie <dirk.laurie@...>
- Date: Sun, 3 May 2015 23:00:39 +0200
2015年05月03日 19:40 GMT+02:00 Nagaev Boris <bnagaev@gmail.com>:
> On Sun, May 3, 2015 at 5:06 PM, Dirk Laurie <dirk.laurie@gmail.com> wrote:
>> If the methods were all provided by the sandbox author, who presumably
>> knows what he is doing, I don't see the problem.
>>
>
> Can a sandbox isolate added string's methods? Can you provide
> sandboxing function passing this test:
>
> string.hack = function() print("Hacked") end
> code = [[ ("just string"):hack() ]]
> sandbox(code)
That's not the way a sandbox operates. A sandbox loads and runs
a string containing code from outside. I.e. the author of that code does not
have access to the sandbox's environment except via his code, which
can access global variables as fields in whatever environment the
sandbox's "load" cares to supply. That environment should not give
access to dangerous tools like the debug library, should lock the
string metatable, and should allow only object-oriented access to
string methods.
- References:
- metatables for strings?, Sam Putman
- Re: metatables for strings?, Nagaev Boris
- Re: metatables for strings?, Sam Putman
- Re: metatables for strings?, Sam Putman
- Re: metatables for strings?, Dirk Laurie
- Re: metatables for strings?, Nagaev Boris
- Re: metatables for strings?, Sam Putman
- Re: metatables for strings?, Dirk Laurie
- Re: metatables for strings?, Nagaev Boris
- Re: metatables for strings?, Dirk Laurie
- Re: metatables for strings?, Nagaev Boris