Function openSafeLibsForTransform

app/src/DataModel/FrameBuilder.cpp:1899–1927

* @brief Opens the safe Lua libraries needed by transforms and strips dangerous globals, including * string.dump whose bytecode serialization paired with a loader is a sandbox-escape vector. */

 *        string.dump whose bytecode serialization paired with a loader is a sandbox-escape vector.
 */
static void openSafeLibsForTransform(lua_State* L)
{
  static const luaL_Reg kSafeLibs[] = {
    {       "_G",      luaopen_base},
    {    "table",     luaopen_table},
    {   "string",    luaopen_string},
    {     "math",      luaopen_math},
    {     "utf8",      luaopen_utf8},
    {"coroutine", luaopen_coroutine},
    {    nullptr,           nullptr}
  };

  for (const luaL_Reg* lib = kSafeLibs; lib->func; ++lib) {
    luaL_requiref(L, lib->name, lib->func, 1);
    lua_pop(L, 1);
  }

  for (const char* name : {"dofile", "loadfile", "load"}) {
    lua_pushnil(L);
    lua_setglobal(L, name);
  }

  lua_getglobal(L, "string");
  if (lua_istable(L, -1)) {
    lua_pushnil(L);
    lua_setfield(L, -2, "dump");
  }
  lua_pop(L, 1);
}

/**
 * @brief Lua LUA_MASKCOUNT hook that aborts runaway transforms via luaL_error() when the per-engine