Function newSandboxedState

pj_scripting/src/luau_engine.cpp:97–122

Create a sandboxed VM: curated stdlib, os/coroutine/debug/setfenv/getfenv dropped, the shared stdlib frozen read-only (luaL_sandbox), then a fresh per-VM writable global table layered on top (luaL_sandboxthread). Net effect: a filter can assign its own top-level globals for persistent state, but cannot mutate the stdlib or leak globals into a sibling filter's VM. Also installs a memory cap + watch

// left OPEN during trusted setup (openlibs/sandbox) and clamped to limits.mem_bytes
// only once setup is done, so a small cap can never make setup fail/abort.
lua_State* newSandboxedState(BudgetState* budget, const BudgetLimits& limits) {
  budget->used = 0;
  budget->max_bytes = std::numeric_limits<std::size_t>::max();  // no cap during setup
  armFuel(budget, limits.setup_fuel);
  lua_State* L = lua_newstate(budgetAlloc, budget);
  if (L == nullptr) {
    return nullptr;
  }
  luaL_openlibs(L);
  // Drop capabilities filters never need; setfenv/getfenv would let a script swap
  // its environment and escape the per-VM globals table back onto the frozen
  // stdlib (or another scope), defeating the sandbox isolation set up below.
  for (const char* lib : {"os", "coroutine", "debug", "setfenv", "getfenv"}) {
    lua_pushnil(L);
    lua_setglobal(L, lib);
  }
  luaL_sandbox(L);  // freeze the shared stdlib read-only
  // Own writable global table for this VM (frozen stdlib as read-only __index):
  // top-level globals the script assigns land here, stdlib reads fall through.
  // One module loads per VM, so safeenv stays on and imports keep the fast path.
  luaL_sandboxthread(L);
  lua_callbacks(L)->userdata = budget;
  lua_callbacks(L)->interrupt = budgetInterrupt;
  budget->max_bytes = limits.mem_bytes;  // cap now applies to all untrusted execution
  return L;
}

// ---- small stack helpers -------------------------------------------------