CODEWITHSUNDEEP
luarequire
Lionel Briand
Lionel Briand

Reputation: 1803

execute lua string as lua code

I want to share lua modules with coworkers. In order to get the latest version of shared modules I want to store and fetch them with a web server.

My questions is:

Is it possible to load lua code directly from http request or string?

I want to achieve something like that :

module = [[
    local sharedModule = {}
    function sharedModule.greet(name) print("hello " .. name) end  
    return sharedModule
]]
greeter = require (module)
greeter.greet("john")

Maybe this is not the right thing to do. Is there a better approach than this one?

Upvotes: 7

Views: 15527

Answers (1)

Bartek Banachewicz
Bartek Banachewicz

Reputation: 39370

There's a whole section in Programming in Lua devoted to that. Your needs will be directly fulfilled with loadstring in Lua 5.1 and older, or load in Lua 5.2 and newer.

I would carefully verify the code you're actually executing, though. At the very least, version it (running a wrong version would most probably end up in all sorts of problems, if the code being run depends on the environment being in a certain state). Optimally checksum and sign the code, and verify the signature before doing anything. If your environment isn't protected, this is essentially a huge backdoor opening.

You could also use rings library to isolate the code you're running within the Lua environment itself. It might not be airtight security-wise, but should at least prevent the received code from crashing your application if/when it goes awry.

Upvotes: 11

Related Questions