Function openSafeLibs

app/src/DataModel/Scripting/LuaScriptEngine.cpp:90–114

* @brief Opens the safe standard libraries and strips dangerous globals. */

 * @brief Opens the safe standard libraries and strips dangerous globals.
 */
static void openSafeLibs(lua_State* L)
{
  Q_ASSERT(L != nullptr);

  for (const luaL_Reg* lib = kSafeLibs; lib->func; ++lib) {
    luaL_requiref(L, lib->name, lib->func, 1);
    lua_pop(L, 1);
  }

  static const char* const kUnsafe[] = {"dofile", "loadfile", "load"};
  for (const char* name : kUnsafe) {
    lua_pushnil(L);
    lua_setglobal(L, name);
  }

  // code-verify off
  // Strip string.dump: bytecode exfiltration vector that pairs with unsafe loaders.
  lua_getglobal(L, "string");
  if (lua_istable(L, -1)) {
    lua_pushnil(L);
    lua_setfield(L, -2, "dump");
  }
  lua_pop(L, 1);
  // code-verify on
}

//--------------------------------------------------------------------------------------------------
// Constructor & destructor