globals.load(new PackageLib()) is necessary? #118

New Issue

open-autonomous-connection · 2024-09-18T08:01:10Z

qiuhuanhen commented

2024-09-18 08:01:10 +00:00

(Migrated from github.com)

Using the lua script in java code, and to reduce the risk, I want to just use the base module,(not all of JsePlatform.standardGlobals()),
it's the config code:

`public class LuaConfig {
private final Globals globals;

public LuaConfig() {

    globals = new Globals();
    globals.load(new JseBaseLib());
    
    // exclude the PackageLib   (管理 Lua 模块和包。允许通过该require()函数加载外部 Lua 模块)
    //globals.load(new PackageLib());
    
    globals.load(new Bit32Lib());
    globals.load(new TableLib());
    globals.load(new StringLib());
    globals.load(new JseMathLib());
    
    LoadState.install(globals);
    LuaC.install(globals);
}

public LuaValue executeLuaScript(String script) {
    // load and exec the script  (加载并执行 Lua 脚本)
    LuaValue chunk = globals.load(script);
    return chunk.call();
}

}`

and throw expection Caused by: org.luaj.vm2.LuaError: attempt to index ? (a nil value) ,
after deubg I found only the JseBaseLib moudle can be loaded without PackageLib;

If load PackageLib , how could I only use the base function and avoid the risk of PackageLib moudule (avoid the Injection Attacks )?

could it be safety completed by next code ?
`
// load other ...
globals.load(new PackageLib());

// don't use require
globals.set("require", LuaValue.NIL);
// load other ...
`

Using the lua script in java code, and to reduce the risk, I want to just use the base module,(not all of JsePlatform.standardGlobals()), it's the config code: `public class LuaConfig { private final Globals globals; public LuaConfig() { globals = new Globals(); globals.load(new JseBaseLib()); // exclude the PackageLib (管理 Lua 模块和包。允许通过该require()函数加载外部 Lua 模块) //globals.load(new PackageLib()); globals.load(new Bit32Lib()); globals.load(new TableLib()); globals.load(new StringLib()); globals.load(new JseMathLib()); LoadState.install(globals); LuaC.install(globals); } public LuaValue executeLuaScript(String script) { // load and exec the script (加载并执行 Lua 脚本) LuaValue chunk = globals.load(script); return chunk.call(); } }` and throw expection Caused by: org.luaj.vm2.LuaError: attempt to index ? (a nil value) , after deubg I found only the JseBaseLib moudle can be loaded without PackageLib; If load PackageLib , how could I only use the base function and avoid the risk of PackageLib moudule (avoid the Injection Attacks )? could it be safety completed by next code ? ` // load other ... globals.load(new PackageLib()); // don't use require globals.set("require", LuaValue.NIL); // load other ... `

qiuhuanhen commented

2024-09-18 08:05:32 +00:00

(Migrated from github.com)

the risk scene could be looked at : script as param in http request

open-autonomous-connection closed this issue

2026-03-01 18:39:12 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: open-autonomous-connection/luaj#118