From f64ec1296115576696544c7694c17b3bd81c3ca1 Mon Sep 17 00:00:00 2001
From: Reinder Feenstra <reinderfeenstra@gmail.com>
Date: Sun, 14 Nov 2021 01:12:39 +0100
Subject: [PATCH] lua: added math, string and table library to sandbox except
 string.dump()

---
 server/src/lua/sandbox.cpp | 75 ++++++++++++++++++++++++++++++--------
 1 file changed, 59 insertions(+), 16 deletions(-)

diff --git a/server/src/lua/sandbox.cpp b/server/src/lua/sandbox.cpp
index 1d1d6716..137c02d4 100644
--- a/server/src/lua/sandbox.cpp
+++ b/server/src/lua/sandbox.cpp
@@ -40,18 +40,20 @@
 #define LUA_SANDBOX "_sandbox"
 #define LUA_SANDBOX_GLOBALS "_sandbox_globals"
 
-#define ADD_GLOBAL_TO_SANDBOX(x) \
-  lua_pushliteral(L, x); \
-  lua_getglobal(L, x); \
-  lua_settable(L, -3);
-
-constexpr std::array<std::string_view, 17> readOnlyGlobals = {{
+constexpr std::array<std::string_view, 23> readOnlyGlobals = {{
   // Lua baselib:
   "assert",
   "type",
   "pairs",
   "ipairs",
+  "next",
+  "tonumber",
+  "tostring",
   "_G",
+  // Lua libs:
+  LUA_MATHLIBNAME,
+  LUA_STRLIBNAME,
+  LUA_TABLIBNAME,
   // Constants:
   "VERSION",
   "VERSION_MAJOR",
@@ -70,6 +72,40 @@ constexpr std::array<std::string_view, 17> readOnlyGlobals = {{
   "set",
 }};
 
+static void addBaseLib(lua_State* L, std::initializer_list<const char*> names)
+{
+  // load Lua baselib:
+  lua_pushcfunction(L, luaopen_base);
+  lua_pushliteral(L, "");
+  lua_call(L, 1, 0);
+
+  for(const char* name : names)
+  {
+    lua_getglobal(L, name);
+    assert(!lua_isnil(L, -1));
+    lua_setfield(L, -2, name);
+  }
+}
+
+static void addLib(lua_State* L, const char* libraryName, lua_CFunction openFunction, std::initializer_list<const char*> names)
+{
+  lua_createtable(L, 0, names.size());
+
+  luaL_requiref(L, libraryName, openFunction, 1);
+
+  for(const char* name : names)
+  {
+    lua_getfield(L, -1, name);
+    assert(!lua_isnil(L, -1));
+    lua_setfield(L, -3, name);
+  }
+
+  lua_pop(L, 1); // pop lib
+
+  Lua::ReadOnlyTable::wrap(L, -1);
+  lua_setfield(L, -2, libraryName);
+}
+
 namespace Lua {
 
 void Sandbox::close(lua_State* L)
@@ -105,11 +141,6 @@ SandboxPtr Sandbox::create(Script& script)
 {
   lua_State* L = luaL_newstate();
 
-  // load Lua baselib:
-  lua_pushcfunction(L, luaopen_base);
-  lua_pushliteral(L, "");
-  lua_call(L, 1, 0);
-
   // create state data:
   *static_cast<StateData**>(lua_getextraspace(L)) = new StateData(script);
 
@@ -135,11 +166,23 @@ SandboxPtr Sandbox::create(Script& script)
   // setup globals:
   lua_newtable(L);
 
-  // add some Lua baselib functions to the sandbox:
-  ADD_GLOBAL_TO_SANDBOX("assert")
-  ADD_GLOBAL_TO_SANDBOX("type")
-  ADD_GLOBAL_TO_SANDBOX("pairs")
-  ADD_GLOBAL_TO_SANDBOX("ipairs")
+  // add Lua lib functions:
+  addBaseLib(L, {
+    "assert", "type", "pairs", "ipairs", "next", "tonumber", "tostring",
+    });
+  addLib(L, LUA_MATHLIBNAME, luaopen_math, {
+    "abs", "acos", "asin", "atan", "ceil", "cos", "deg", "exp",
+    "floor", "fmod", "huge", "log", "max", "maxinteger", "min", "mininteger",
+    "modf", "pi", "rad", "random", "randomseed", "sin", "sqrt", "tan",
+    "tointeger", "type", "ult",
+    });
+  addLib(L, LUA_STRLIBNAME, luaopen_string, {
+    "byte", "char", "find", "format", "gmatch", "gsub", "len", "lower",
+    "match", "pack", "packsize", "rep", "reverse", "sub", "unpack", "upper",
+    });
+  addLib(L, LUA_TABLIBNAME, luaopen_table, {
+    "concat", "insert", "pack", "unpack", "remove", "move", "sort",
+    });
 
   // set VERSION:
   lua_pushstring(L, TRAINTASTIC_VERSION);