Re: Userland Lua - concerns with require

[Marc Balmer <mbalmer%NetBSD.org@localhost>]

Please note that we are currently working on an unresolved security
concern that jmcneill brought up in a private conversation.

The "require" keyword can be used to load modules.  Lua will look for
modules in a user defineable path, LUA_PATH.  The default settings for
LUA_PATH include the current working directory, even before the other
locations.

We want to make sure this can not be used to trick someone into running
malicious code, possibly even the root user.

To illustrate the concern, see below the (error) output from Lua when
trying to load a non-existing module "x":

Lua 5.1.4  Copyright (C) 1994-2008 Lua.org, PUC-Rio
> require "x"
stdin:1: module 'x' not found:
        no field package.preload['x']
        no file './x.lua'
        no file '/usr/share/lua/5.1/x.lua'
        no file '/usr/share/lua/5.1/x/init.lua'
        no file '/usr/lib/lua/5.1/x.lua'
        no file '/usr/lib/lua/5.1/x/init.lua'
        no file './x.so'
        no file '/usr/lib/lua/5.1/x.so'
        no file '/usr/lib/lua/5.1/loadall.so'
stack traceback:
        [C]: in function 'require'
        stdin:1: in main chunk
        [C]: ?
>