apitools / sandbox.lua Goto Github PK

By using quota = false, the hooks should not be in place.

Hey, can sandbox.lua also protect the LuaJit engine? Would be nice to have a compatible sandbox.

I don't care so much about CPU limits, more like "real" security issues like deleting files.

Many regards,
kung foo man

That's sure to be an interesting journey

Hello,

I wonder why os.date is not present in the sandbox ?
Is this function is dangerous ? or is it a mistake ?

Best Regards,

Due to what appears to be an interpreter bug, you can cause infinite loops in LuaJIT. The loops are not allowed in Lua 5.1 and 5.2. Due to the sensitive nature of this bug, and the fact that I don't know how widely this is used, I won't specify how to cause the loops. E-Mail me or contact me on freenode IRC (nick=ShadowNinja) for details, unless you think that nobody much uses this with LuaJIT. :-) As far as I know there's no way to fix this other than to sanitize the input or switch to non-JIT Lua.

My use case right now involves using the sandbox not to stop infinite loops, but to make sure an outside condition can stop whatever's running in the sandbox (I'm using the Love2D engine, which allows me to run threads, so my stop condition is based on another thread running concurrently).

I will implement this myself within my project, but I will also send a pull request if I feel it is worth sharing, and if anyone else finds it useful.

Also, make immune absence of debug.sehook

How to detect and disallow slow pattern matching?

("a"):rep(100):match(patt)

where patt might be:

• 'a+a+b': too low to measure
• 'a+a+a+b': 0.08 seconds
• 'a+a+a+a+b': 1.3 seconds
• 'a+a+a+a+a+b': 20.3 seconds