lua states now always start in a sandbox where all dangerous stdLib objects are removed

Author: crankycyclops

Changelog.md

@@ -1,6 +1,16 @@
 
 # Change Log
 
+## [0.91.6] - 2026-06-06
+
+### Security
+
+- Embedded Lua scripts are now run in a restricted sandbox. The core now opens only a subset of safe libraries (`base`, `table`, `string`, `math`, `coroutine`, and `utf8` on Lua 5.3+) and strips the dangerous globals (`os`, `io`, `package`, `debug`, `require`, `load`, `loadstring`, `loadfile`, `dofile`, `collectgarbage`.)
+
+### Fixed
+
+- The standalone build now properly checks for either SQLite or JSON serialization support
+
 ## [0.91.4] - 2023-02-20
 
 ### Changed

src/core/CMakeLists.txt

@@ -6,7 +6,7 @@ set(CMAKE_MODULE_PATH "${CMAKE_MODULE_PATH};${CMAKE_CURRENT_SOURCE_DIR}/cmake")
 # Current version of the library
 set(TROGDOR_VERSION_MAJOR 0)
 set(TROGDOR_VERSION_MINOR 91)
-set(TROGDOR_VERSION_PATCH 5)
+set(TROGDOR_VERSION_PATCH 6)
 
 configure_file(${CMAKE_CURRENT_LIST_DIR}/cmake/version.h.in ${CMAKE_CURRENT_BINARY_DIR}/version.h @ONLY)
 

src/core/include/trogdor/lua/luastate.h

@@ -121,6 +121,51 @@ namespace trogdor {
             L = luaL_newstate();
          }
 
+         /*
+            Opens only a safe subset of the Lua standard library by loading
+            everything, then stripping out anything we consider unsafe.
+
+            Input:
+               (none)
+
+            Output:
+               (none)
+         */
+         inline void openSafeLibs() {
+
+            // Safe standard libraries: base (for pairs/type/tostring/pcall/...)
+            // plus the pure table/string/math/coroutine helpers
+            static const luaL_Reg safeLibs[] = {
+               {"_G",            luaopen_base},
+               {LUA_TABLIBNAME,  luaopen_table},
+               {LUA_STRLIBNAME,  luaopen_string},
+               {LUA_MATHLIBNAME, luaopen_math},
+               {LUA_COLIBNAME,   luaopen_coroutine},
+               #if LUA_VERSION_NUM >= 503
+                  {LUA_UTF8LIBNAME, luaopen_utf8},
+               #endif
+               {nullptr, nullptr}
+            };
+
+            for (const luaL_Reg *lib = safeLibs; lib->func; lib++) {
+               luaL_requiref(L, lib->name, lib->func, 1);
+               lua_pop(L, 1); // luaL_requiref leaves the module on the stack
+            }
+
+            // Strip dangerous globals from the base library
+            static const char *unsafeGlobals[] = {
+               "load", "loadstring", "loadfile", "dofile",
+               "require", "collectgarbage", "package",
+               "os", "io", "debug",
+               nullptr
+            };
+
+            for (const char **name = unsafeGlobals; *name; name++) {
+               lua_pushnil(L);
+               lua_setglobal(L, *name);
+            }
+         }
+
          /*
             Opens libraries and registers API stuff.
 
@@ -132,12 +177,8 @@ namespace trogdor {
          */
          inline void initLibs() {
 
-            // load standard library
-            // TODO: only open certain standard libraries. I don't, for example,
-            // want to allow things like os.exit(). Hold off on this until I
-            // migrate to Lua 5.2+. The answer to this seems to be here:
-            // https://stackoverflow.com/questions/4551101/lual-openlibs-and-sandboxing-scripts
-            luaL_openlibs(L);
+            // Open only a safe subset of the standard library
+            openSafeLibs();
 
             // register Game type as well as a global instance of it
             // corresponding to the game that spawned the instance of LuaState

src/core/test/lua/luastate.cpp

@@ -539,6 +539,83 @@ TEST_SUITE("LuaState (luastate.cpp)") {
 		// TODO: test blank string, string with syntax errors, and string with valid Lua
 	}
 
+	TEST_CASE("LuaState (luastate.cpp): Lua sandbox: dangerous stdlib is removed") {
+
+		std::unique_ptr<trogdor::Game> game = std::make_unique<trogdor::Game>(
+			std::make_unique<trogdor::NullErr>()
+		);
+
+		trogdor::LuaState L(game.get());
+
+		// Every dangerous global must be absent from an untrusted script's view.
+		// The script returns true only if all of them are nil.
+		L.loadScriptFromString(
+			"function sandboxCheck()\n"
+			"   local blocked = {\n"
+			"      'os', 'io', 'package', 'debug', 'require',\n"
+			"      'load', 'loadstring', 'loadfile', 'dofile', 'collectgarbage'\n"
+			"   }\n"
+			"   for _, name in pairs(blocked) do\n"
+			"      if _G[name] ~= nil then return false end\n"
+			"   end\n"
+			"   return true\n"
+			"end\n"
+		);
+
+		L.call("sandboxCheck");
+		L.execute(1);
+
+		if (!L.getBoolean(0)) {
+			FAIL("A dangerous standard-library global is still exposed to Lua scripts.");
+		}
+	}
+
+	TEST_CASE("LuaState (luastate.cpp): Lua sandbox: safe stdlib remains available") {
+
+		std::unique_ptr<trogdor::Game> game = std::make_unique<trogdor::Game>(
+			std::make_unique<trogdor::NullErr>()
+		);
+
+		trogdor::LuaState L(game.get());
+
+		// The safe libraries (and core base functions) that bundled game
+		// scripts rely on must still be present
+		L.loadScriptFromString(
+			"function safeLibsCheck()\n"
+			"   return type(string) == 'table'\n"
+			"      and type(table) == 'table'\n"
+			"      and type(math) == 'table'\n"
+			"      and type(pairs) == 'function'\n"
+			"      and type(tostring) == 'function'\n"
+			"      and type(pcall) == 'function'\n"
+			"end\n"
+		);
+
+		L.call("safeLibsCheck");
+		L.execute(1);
+
+		if (!L.getBoolean(0)) {
+			FAIL("A safe standard-library function expected by game scripts is missing.");
+		}
+	}
+
+	TEST_CASE("LuaState (luastate.cpp): Lua sandbox (C1): RCE attempt fails safely") {
+
+		std::unique_ptr<trogdor::Game> game = std::make_unique<trogdor::Game>(
+			std::make_unique<trogdor::NullErr>()
+		);
+
+		trogdor::LuaState L(game.get());
+
+		// A classic os.execute() RCE attempt must not run. Indexing the now nil
+		// 'os' global should raise a Lua error (LuaException) rather than
+		// executing a shell command or crashing.
+		CHECK_THROWS_AS(
+			L.loadScriptFromString("os.execute(\"echo pwned\")\n"),
+			trogdor::LuaException
+		);
+	}
+
 	TEST_CASE("LuaState (luastate.cpp): All variants of pushArgument()") {
 
 		// TODO