smokephil/ardour
1
0
Fork 0
mirror of https://github.com/Ardour/ardour.git synced 2025-12-07 15:25:01 +01:00
Code Issues Projects Releases Wiki Activity

Centralize Lua sandboxing

Browse source
This commit is contained in:
Robin Gareus 2017-08-09 04:07:23 +02:00
parent cba622cdce
commit 0191a9c4c2
5 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
libs/ardour/luaproc.cc
View file

@ -163,7 +163,7 @@ LuaProc::init ()
lua_setglobal (L, "self"); lua_setglobal (L, "self");
// sandbox // sandbox
lua.do_command ("io = nil os = nil loadfile = nil require = nil dofile = nil package = nil debug = nil"); lua.sandbox (true);
#if 0 #if 0
lua.do_command ("for n in pairs(_G) do print(n) end print ('----')"); // print global env lua.do_command ("for n in pairs(_G) do print(n) end print ('----')"); // print global env
#endif #endif

9
libs/ardour/luascripting.cc
View file

@ -179,8 +179,7 @@ LuaScripting::scan_script (const std::string &fn, const std::string &sc)
lua_State* L = lua.getState(); lua_State* L = lua.getState();
lua.Print.connect (&LuaScripting::lua_print); lua.Print.connect (&LuaScripting::lua_print);
lua.sandbox (true);
lua.do_command ("io = nil;");
lua.do_command ( lua.do_command (
"ardourluainfo = {}" "ardourluainfo = {}"
@ -339,7 +338,7 @@ LuaScriptParams::script_params (const std::string& s, const std::string &pname,
LuaState lua; LuaState lua;
lua_State* L = lua.getState(); lua_State* L = lua.getState();
lua.do_command ("io = nil;"); lua.sandbox (true);
lua.do_command ("function ardour () end"); lua.do_command ("function ardour () end");
try { try {
@ -416,6 +415,7 @@ LuaScripting::try_compile (const std::string& script, const LuaScriptParamList&
} }
LuaState l; LuaState l;
l.Print.connect (&LuaScripting::lua_print); l.Print.connect (&LuaScripting::lua_print);
l.sandbox (true);
lua_State* L = l.getState(); lua_State* L = l.getState();
l.do_command ("" l.do_command (""
@ -425,7 +425,7 @@ LuaScripting::try_compile (const std::string& script, const LuaScriptParamList&
" assert(type(f) == 'string', 'Assigned ByteCode must be string')" " assert(type(f) == 'string', 'Assigned ByteCode must be string')"
" local factory = load(f)" " local factory = load(f)"
" assert(type(factory) == 'function', 'Factory is a not a function')" " assert(type(factory) == 'function', 'Factory is a not a function')"
" local env = _ENV; env.f = nil env.debug = nil os.exit = nil" " local env = _ENV; env.f = nil env.os = nil env.io = nil"
" load (string.dump(factory, true), nil, nil, env)(a)" " load (string.dump(factory, true), nil, nil, env)(a)"
" end" " end"
); );
@ -454,6 +454,7 @@ LuaScripting::get_factory_bytecode (const std::string& script, const std::string
{ {
LuaState l; LuaState l;
l.Print.connect (&LuaScripting::lua_print); l.Print.connect (&LuaScripting::lua_print);
l.sandbox (true);
lua_State* L = l.getState(); lua_State* L = l.getState();
l.do_command ( l.do_command (

2
libs/ardour/session.cc
View file

@ -5500,6 +5500,7 @@ Session::setup_lua ()
lua.Print.connect (&_lua_print); lua.Print.connect (&_lua_print);
#endif #endif
lua.tweak_rt_gc (); lua.tweak_rt_gc ();
lua.sandbox (true);
lua.do_command ( lua.do_command (
"function ArdourSession ()" "function ArdourSession ()"
" local self = { scripts = {}, instances = {} }" " local self = { scripts = {}, instances = {} }"
@ -5516,7 +5517,6 @@ Session::setup_lua ()
" assert(type(a) == 'table' or type(a) == 'nil', 'Given argument is invalid')" " assert(type(a) == 'table' or type(a) == 'nil', 'Given argument is invalid')"
" assert(self.scripts[n] == nil, 'Callback \"'.. n ..'\" already exists.')" " assert(self.scripts[n] == nil, 'Callback \"'.. n ..'\" already exists.')"
" self.scripts[n] = { ['f'] = f, ['a'] = a }" " self.scripts[n] = { ['f'] = f, ['a'] = a }"
" local env = _ENV; env.f = nil env.io = nil env.os = nil env.loadfile = nil env.require = nil env.dofile = nil env.package = nil env.debug = nil"
" local env = { print = print, tostring = tostring, assert = assert, ipairs = ipairs, error = error, select = select, string = string, type = type, tonumber = tonumber, collectgarbage = collectgarbage, pairs = pairs, math = math, table = table, pcall = pcall, bit32=bit32, Session = Session, PBD = PBD, Timecode = Timecode, Evoral = Evoral, C = C, ARDOUR = ARDOUR }" " local env = { print = print, tostring = tostring, assert = assert, ipairs = ipairs, error = error, select = select, string = string, type = type, tonumber = tonumber, collectgarbage = collectgarbage, pairs = pairs, math = math, table = table, pcall = pcall, bit32=bit32, Session = Session, PBD = PBD, Timecode = Timecode, Evoral = Evoral, C = C, ARDOUR = ARDOUR }"
" self.instances[n] = load (string.dump(f, true), nil, nil, env)(a)" " self.instances[n] = load (string.dump(f, true), nil, nil, env)(a)"
" Session:scripts_changed()" // call back " Session:scripts_changed()" // call back

1
libs/lua/lua/luastate.h
View file

@ -36,6 +36,7 @@ public:
void collect_garbage (); void collect_garbage ();
void collect_garbage_step (); void collect_garbage_step ();
void tweak_rt_gc (); void tweak_rt_gc ();
void sandbox (bool rt_safe = false);
sigc::signal<void,std::string> Print; sigc::signal<void,std::string> Print;

9
libs/lua/luastate.cc
View file

@ -88,6 +88,15 @@ LuaState::tweak_rt_gc () {
lua_gc (L, LUA_GCSETSTEPMUL, 100); lua_gc (L, LUA_GCSETSTEPMUL, 100);
} }
void
LuaState::sandbox (bool rt_safe) {
do_command ("loadfile = nil dofile = nil require = nil dofile = nil package = nil debug = nil os.exit = nil os.setlocale = nil rawget = nil rawset = nil coroutine = nil module = nil");
if (rt_safe) {
do_command ("os = nil io = nil");
}
}
void void
LuaState::print (std::string text) { LuaState::print (std::string text) {
Print (text); /* EMIT SIGNAL */ Print (text); /* EMIT SIGNAL */