Lua Why is “required” unsafe for use in a sandbox environment?

Question

Through this page, http://lua-users.org/wiki/SandBoxes require is marked as unsafe, but because:

• modifies global variables (e.g. package.loaded)
• provides access to environments outside the sandbox
• and accesses the file system

Almost all pure Lua libraries use "require", so not being safe is a huge pain because you cannot use pure Lua libraries. I do not understand these unsafe reasons. It uploads other Lua files to the library. Why is it unsafe?

Answer 1

Demand loading and executing code in a global environment.

, (Lua >= 5.2):

-- example.lua
my_global = 42

local sandbox
do
  local _ENV = { require = require, print = print }

  function sandbox()
    print('<sandbox> my_global =', my_global)
    require 'example_module'
  end
end

print('<global> my_global =', my_global)
sandbox()
print('<global> my_global =', my_global)

, my_global:

-- example_module.lua
print('<module> my_global =', my_global)
my_global = nil

, require print. my_global.

, :

$ lua example.lua
<global> my_global =    42      -- The global environment, Ok.
<sandbox> my_global =   nil     -- Inside the sandbox, Ok.
<module> my_global =    42      -- Inside the sandbox, but loaded with require. Whoops, we have access to the global environment.
<global> my_global =    nil     -- The module changed the value and it is reflected in the global environment.

.

Answer 2

, , .

require, . , , , "" .