Merge branch 'master'

src/lua-env-safe.lua

@@ -14,6 +14,7 @@ local old_require = require
 local old_os = os
 local old_debug = debug
 local old_package = package
+local old_allowffi = _bllua_allowffi
 
 -- Remove all global variables except a whitelist
 local ok_names = tmap {
@@ -39,13 +40,10 @@ end
 
 -- Sanitize file paths to point only to allowed files within the game directory
 -- List of allowed directories for reading/writing
+-- modules/lualib is also allowed as read-only
 local allowed_dirs = tmap {
   'add-ons', 'base', 'config', 'saves', 'screenshots', 'shaders'
 }
--- List of allowed directories for reading only
-local allowed_dirs_readonly = tmap {
-  'lualib'
-}
 -- List of disallowed file extensions - basically executable file extensions
 -- Note that even without this protection, exploiting would still require somehow
 --   getting a file within the allowed directories to autorun,
@@ -81,14 +79,15 @@ local function safe_path(fn, readonly)
   end
   -- allow only whitelisted dirs
   local dir = fn:match('^([^/]+)/')
-  if (not dir) or (
-        (not allowed_dirs[dir:lower()]) and
-        ((not readonly) or (not allowed_dirs_readonly[dir:lower()]))) then
-    return nil, 'filename is in disallowed directory ' .. (dir or 'nil')
+  if not (dir and (
+        allowed_dirs[dir:lower()] or
+        (readonly and fn:find('^modules/lualib/'))))
+  then
+    return nil, 'File is in disallowed directory ' .. (dir or 'nil')
   end
-  -- disallow blacklisted extensions or no extension
+  -- disallow blacklisted extensions
   local ext = fn:match('%.([^/%.]+)$')
-  if (not ext) or (disallowed_exts[ext:lower()]) then
+  if ext and disallowed_exts[ext:lower()] then
     return nil, 'Filename \'' .. fn .. '\' has disallowed extension \'' ..
         (ext or '') .. '\''
   end
@@ -120,6 +119,7 @@ local disallowed_packages = tmap {
   'ffi', 'debug', 'package', 'io', 'os',
   '_bllua_ts',
 }
+if old_allowffi then disallowed_packages['ffi'] = nil end
 function _bllua_requiresecure(name)
   if name:find('[^a-zA-Z0-9_%-%.]') or name:find('%.%.') or
       name:find('^%.') or name:find('%.$') then