actions/itgmania212121
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove unsafe package library

Browse Source 
package.loadlib() can be used to load a dynamic C library allowing
arbitrary code execution in mod charts and themes.

So far I haven't found any theme that depends on the library, so I think
removing it shouldn't break anything.
This commit is contained in:
Martin Natano
2022-03-04 21:27:55 +01:00
parent 568f21b6b3
commit afb3836367
3 changed files with 0 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/LuaManager.cpp
-7
View File
@@ -263,13 +263,6 @@ LuaManager::LuaManager()
lua_pushcfunction( L, luaopen_string ); lua_call( L, 0, 0 );
lua_pushcfunction( L, luaopen_table ); lua_call( L, 0, 0 );
lua_pushcfunction( L, luaopen_debug ); lua_call( L, 0, 0 );
lua_pushcfunction( L, luaopen_package ); lua_call( L, 0, 0 ); // this one seems safe -shake
// these two can be dangerous. don't use them
// (unless you know what you are doing). -aj
#if 0
lua_pushcfunction( L, luaopen_io ); lua_call( L, 0, 0 );
lua_pushcfunction( L, luaopen_os ); lua_call( L, 0, 0 );
#endif
// Store the thread pool in a table on the stack, in the main thread.
#define THREAD_POOL 1