Commit a3f99081 authored by antirez's avatar antirez
Browse files

Remove loadfile() access from the scripting engine.

parent eb6e7eb9
...@@ -412,6 +412,13 @@ void luaLoadLibraries(lua_State *lua) { ...@@ -412,6 +412,13 @@ void luaLoadLibraries(lua_State *lua) {
#endif #endif
} }
/* Remove a functions that we don't want to expose to the Redis scripting
* environment. */
void luaRemoveUnsupportedFunctions(lua_State *lua) {
lua_pushnil(lua);
lua_setglobal(lua,"loadfile");
}
/* This function installs metamethods in the global table _G that prevent /* This function installs metamethods in the global table _G that prevent
* the creation of globals accidentally. * the creation of globals accidentally.
* *
...@@ -455,7 +462,9 @@ void scriptingEnableGlobalsProtection(lua_State *lua) { ...@@ -455,7 +462,9 @@ void scriptingEnableGlobalsProtection(lua_State *lua) {
* See scriptingReset() for more information. */ * See scriptingReset() for more information. */
void scriptingInit(void) { void scriptingInit(void) {
lua_State *lua = lua_open(); lua_State *lua = lua_open();
luaLoadLibraries(lua); luaLoadLibraries(lua);
luaRemoveUnsupportedFunctions(lua);
/* Initialize a dictionary we use to map SHAs to scripts. /* Initialize a dictionary we use to map SHAs to scripts.
* This is useful for replication, as we need to replicate EVALSHA * This is useful for replication, as we need to replicate EVALSHA
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment