Re: Making a secure sandbox containing getfenv()

["Patrick Donnelly" <batrick.donnelly@...>]

I just tried using this:

secureenviron = {
  getfenv = function(...)
    return _G.getfenv(...)
  end,
  --... other lua functions
}
for _,v in pairs(secureenviron) do
  if type(v) == "function" then setfenv(v, secureenviron) end
end

This protects against: getfenv(getfenv) to get ahold of the global
table, I have no idea how to prevent climbing the stack levels to get
at the global environment other than raising an error. Doing simple
checks to see if the table returned by getfenv() is the global table
seems prone to errors (and attack).

-- 
-Patrick Donnelly

"One of the lessons of history is that nothing is often a good thing
to do and always a clever thing to say."

-Will Durant