Re: Secure tables in Lua: Summary

[David Given <dg@...>]

Diego Nehab wrote:
[...]
> If the object's metatable has a "__metatable" field,
> getmetatable() returns the associated value.  Can't you use
> this trick to protect the datastructure? setmetatable() will
> also honor __metatable by raising an error.

I was not previously aware of this feature --- rather useful.

Having just rummaged through the documentation for this stuff, I am now
struck with rawget() and rawset(), that allow you to access table
entries bypassing the metatable...

t = create_secure_table_with_public_api()
local oldfn = t.apifunction
rawset(t, "apifunction", function(self, capability)
  print("Stolen capability "..capability.."!")
  return oldfn(self, capability)
end

Is there a way of disabling these as well?

-- 
┌─── ｄｇ＠ｃｏｗｌａｒｋ．ｃｏｍ ───── http://www.cowlark.com ─────
│ "I have always wished for my computer to be as easy to use as my
│ telephone; my wish has come true because I can no longer figure out
│ how to use my telephone." --- Bjarne Stroustrup

Attachment: signature.asc
Description: OpenPGP digital signature