Make load() only usable in debug mode

This commit is contained in:
Mm2PL 2023-02-12 22:46:32 +01:00
parent e899599034
commit f3ee061f7f
3 changed files with 10 additions and 1 deletions

View file

@ -145,6 +145,7 @@ end
#### `load(chunk [, chunkname [, mode [, env]]])` #### `load(chunk [, chunkname [, mode [, env]]])`
This function is only available if Chatterino is compiled in debug mode. It is meant for debugging with little exception.
This function behaves really similarity to Lua's `load`, however it does not allow for bytecode to be executed. This function behaves really similarity to Lua's `load`, however it does not allow for bytecode to be executed.
It achieves this by forcing all inputs to be encoded with `UTF-8`. It achieves this by forcing all inputs to be encoded with `UTF-8`.

View file

@ -162,6 +162,10 @@ int c2_log(lua_State *L)
int g_load(lua_State *L) int g_load(lua_State *L)
{ {
#ifdef NDEBUG
luaL_error(L, "load() is only usable in debug mode");
return 0;
#else
auto countArgs = lua_gettop(L); auto countArgs = lua_gettop(L);
QByteArray data; QByteArray data;
if (lua::peek(L, &data, 1)) if (lua::peek(L, &data, 1))
@ -199,6 +203,7 @@ int g_load(lua_State *L)
lua_call(L, countArgs, LUA_MULTRET); lua_call(L, countArgs, LUA_MULTRET);
return lua_gettop(L); return lua_gettop(L);
#endif
} }
int g_dofile(lua_State *L) int g_dofile(lua_State *L)

View file

@ -168,10 +168,13 @@ void PluginController::openLibrariesFor(lua_State *L,
lua_pushglobaltable(L); lua_pushglobaltable(L);
auto gtable = lua_gettop(L); auto gtable = lua_gettop(L);
lua_getfield(L, gtable, "load");
// possibly randomize this name at runtime to prevent some attacks? // possibly randomize this name at runtime to prevent some attacks?
#ifndef NDEBUG
lua_getfield(L, gtable, "load");
lua_setfield(L, LUA_REGISTRYINDEX, "real_load"); lua_setfield(L, LUA_REGISTRYINDEX, "real_load");
#endif
lua_getfield(L, gtable, "dofile"); lua_getfield(L, gtable, "dofile");
lua_setfield(L, LUA_REGISTRYINDEX, "real_dofile"); lua_setfield(L, LUA_REGISTRYINDEX, "real_dofile");