Because of the MT Lua security model I can’t use require if I don’t mark the mod as a ”trusted mod”. Now, luarocks has a lot of useful libraries but enabling them for a mod requires the use of require, so to speak. I still want the mod securely sandboxed. Is there a way to use dofile instead somehow? I don’t care if it’s ugly.
It’s weird to me that the modding API is designed in a way that can’t leverage the power of external generic Lua libraries by default.
[Solved] Can I use dofile instead of require somehow?
- texmex
- Member
- Posts: 1753
- Joined: Mon Jul 11, 2016 21:08
- GitHub: tacotexmex
- In-game: tacotexmex
[Solved] Can I use dofile instead of require somehow?
Last edited by texmex on Mon Jun 03, 2019 20:22, edited 2 times in total.
- Krock
- Developer
- Posts: 4650
- Joined: Thu Oct 03, 2013 07:48
- GitHub: SmallJoker
- Location: Switzerland
- Contact:
Re: Can I use dofile instead of require somehow?
If there was a way, the mod security would be kinda pointless because any mod could just run code from any C library. Note that C code cannot be protected by Minetest, thus `require` has to be guarded in any case.
There's no sane workaround for this. I think there are still ways to leak the insecure environment, but that's surely not your goal.
There's no sane workaround for this. I think there are still ways to leak the insecure environment, but that's surely not your goal.
Look, I programmed a bug for you. >> Mod Search Engine << - Mods by Krock - DuckDuckGo mod search bang: !mtmod <keyword here>
- texmex
- Member
- Posts: 1753
- Joined: Mon Jul 11, 2016 21:08
- GitHub: tacotexmex
- In-game: tacotexmex
Re: Can I use dofile instead of require somehow?
Thank you for clarifying.
So allowing require allows for code execution not only of other Lua libs but C (and others?) as well?
So allowing require allows for code execution not only of other Lua libs but C (and others?) as well?
- Krock
- Developer
- Posts: 4650
- Joined: Thu Oct 03, 2013 07:48
- GitHub: SmallJoker
- Location: Switzerland
- Contact:
Re: Can I use dofile instead of require somehow?
As soon the function `int luaopen_MYLIBRARY(lua_State *L)` is exported to the dynamic library/Lua, it's possible to load it from Lua using `require` and call functions which were added inside that constructor-like function.texmex wrote:So allowing require allows for code execution not only of other Lua libs but C (and others?) as well?
Look, I programmed a bug for you. >> Mod Search Engine << - Mods by Krock - DuckDuckGo mod search bang: !mtmod <keyword here>
- texmex
- Member
- Posts: 1753
- Joined: Mon Jul 11, 2016 21:08
- GitHub: tacotexmex
- In-game: tacotexmex
Re: Can I use dofile instead of require somehow?
Right. Again, thanks for clarifying. :)
- rubenwardy
- Moderator
- Posts: 6972
- Joined: Tue Jun 12, 2012 18:11
- GitHub: rubenwardy
- IRC: rubenwardy
- In-game: rubenwardy
- Location: Bristol, United Kingdom
- Contact:
Re: Can I use dofile instead of require somehow?
Require does not load any C code or Lua by itself.
1. Require first checks if the module has already been loaded, and if so returns it from the cache.
2. Require then attempts to find the module in the package path
3. Require calls dofile on the module
so, in code:
The reason that require is currently disabled is because it is hardcoded to use Lua's dofile rather than our own safe dofile.
Here is a PR which adds our own safe require: https://github.com/minetest/minetest/pull/7621
1. Require first checks if the module has already been loaded, and if so returns it from the cache.
2. Require then attempts to find the module in the package path
3. Require calls dofile on the module
so, in code:
Code: Select all
function require(name)
-- Don't load twice
if registry.__loaded[name] then
return registry.__loaded[name]
end
-- find main lua file for given module
local path = find(name)
-- dofile
local ret = dofile(path)
registry.__loaded[name] = ret
return ret
end
Here is a PR which adds our own safe require: https://github.com/minetest/minetest/pull/7621
- texmex
- Member
- Posts: 1753
- Joined: Mon Jul 11, 2016 21:08
- GitHub: tacotexmex
- In-game: tacotexmex
Re: [Solved, no] Can I use dofile instead of require somehow
In my case I wanted to use a csv library and so I tried to include it with dofile. If the functions inside where global instead of local it seemed that it could’ve worked. I assumed require would deal with this namespace thing but I’ve no idea how it works.
- rubenwardy
- Moderator
- Posts: 6972
- Joined: Tue Jun 12, 2012 18:11
- GitHub: rubenwardy
- IRC: rubenwardy
- In-game: rubenwardy
- Location: Bristol, United Kingdom
- Contact:
Re: [Solved, no] Can I use dofile instead of require somehow
You can return things through dofile too. If the library is in pure Lua, you can just include it in your mod and replace any require calls with dofile calls with exact pathstexmex wrote:In my case I wanted to use a csv library and so I tried to include it with dofile. If the functions inside where global instead of local it seemed that it could’ve worked. I assumed require would deal with this namespace thing but I’ve no idea how it works.
- texmex
- Member
- Posts: 1753
- Joined: Mon Jul 11, 2016 21:08
- GitHub: tacotexmex
- In-game: tacotexmex
Re: [Solved, no] Can I use dofile instead of require somehow
Oh okay. Maybe I just didn’t know what I was doing. Kudos for making that PR, I hope it will be merged some day. Like, I know modders usually want to write selfcontained mods without dependencies but at some point reinventing wheels instead of building actual games gets tiresome.
Who is online
Users browsing this forum: No registered users and 2 guests