diff --git a/include/tarantool_lua.h b/include/tarantool_lua.h index 0c4fc9456a50715ef176505f7014c13792c264bd..83aefc03e6037e660230c43ddfdc4bee58b39fdd 100644 --- a/include/tarantool_lua.h +++ b/include/tarantool_lua.h @@ -93,7 +93,7 @@ tarantool_lua_load_cfg(struct lua_State *L, /** * Load and execute start-up file * - * @param L is Lua State + * @param L is a Lua State. */ void tarantool_lua_load_init_script(struct lua_State *L); diff --git a/mod/box/box.lua b/mod/box/box.lua index e5aa65459229484789fa911be9471dbb9339ae14..10d395c3e8f1331ca91c69c09c4aa3db40204d03 100644 --- a/mod/box/box.lua +++ b/mod/box/box.lua @@ -324,12 +324,4 @@ function box.on_reload_configuration() end end --- security: nullify some of the most serious os.* holes -os.execute = nil -os.exit = nil -os.rename = nil -os.tmpname = nil -os.remove = nil -require = nil - -- vim: set et ts=4 sts diff --git a/src/tarantool.m b/src/tarantool.m index cccf7859f03829b32ec3864e3edbbf43ab256a73..742f43e09843ec391a2323b0d20f371fa37856ba 100644 --- a/src/tarantool.m +++ b/src/tarantool.m @@ -725,10 +725,10 @@ main(int argc, char **argv) replication_init(); /* - * Load user init script. - * The script should have access to Tarantool Lua API (box.cfg, - * box.fiber, etc...) that is why script must run only after the server - * was fully initialized. + * Load user init script. The script should have access + * to Tarantool Lua API (box.cfg, box.fiber, etc...) that + * is why script must run only after the server was fully + * initialized. */ tarantool_lua_load_init_script(tarantool_L); diff --git a/src/tarantool_lua.m b/src/tarantool_lua.m index de5b2d5bfe839ad3bda7605e006f9ddafa3179fa..5eb5709ef24984f7d9a51c75b2e52c4700a4f3ef 100644 --- a/src/tarantool_lua.m +++ b/src/tarantool_lua.m @@ -1175,6 +1175,33 @@ load_init_script(void *L_ptr) */ } +/** + * Unset functions in the Lua state which can be used to + * execute external programs or otherwise introduce a breach + * in security. + * + * @param L is a Lua State. + */ +static void +tarantool_lua_sandbox(struct lua_State *L) +{ + /* + * Unset some functions for security reasons: + * 1. Some os.* functions (like os.execute, os.exit, etc..) + * 2. require(), since it can be used to provide access to ffi + * or anything else we unset in 1. + */ + int result = tarantool_lua_dostring(L, + "os.execute = nil\n" + "os.exit = nil\n" + "os.rename = nil\n" + "os.tmpname = nil\n" + "os.remove = nil\n" + "require = nil\n"); + if (result) + panic("%s", lua_tostring(L, -1)); +} + void tarantool_lua_load_init_script(struct lua_State *L) { @@ -1188,6 +1215,11 @@ tarantool_lua_load_init_script(struct lua_State *L) struct fiber *loader = fiber_create(TARANTOOL_LUA_INIT_SCRIPT, -1, load_init_script, L); fiber_call(loader); + /* Outside the startup file require() or ffi are not + * allowed. + */ + tarantool_lua_sandbox(tarantool_L); + } /* diff --git a/test/box/lua.result b/test/box/lua.result index f8117e9204547ccc58c89f31039fb8b1dfaaa73e..66c25dbaec6d8011f1623346cb9c1a753432d69e 100644 --- a/test/box/lua.result +++ b/test/box/lua.result @@ -1220,6 +1220,21 @@ lua box.select(0, 0, 4) - 4: {8, 16} ... +# Test bug #1002272 + +lua floor(0.5) +--- + - 0 +... +lua floor(0.9) +--- + - 0 +... +lua floor(1.1) +--- + - 1 +... + # clean-up after tests diff --git a/test/box/lua.test b/test/box/lua.test index bc89b0d08497ba19d982ec095ef4c39e127ea257..695e845a4b5a2a7d0eb591dc0cdff75c54b5d72a 100644 --- a/test/box/lua.test +++ b/test/box/lua.test @@ -415,6 +415,13 @@ exec admin "lua box.select(0, 0, 1)" exec admin "lua box.select(0, 0, 2)" exec admin "lua box.select(0, 0, 4)" +print """ +# Test bug #1002272 +""" +exec admin "lua floor(0.5)" +exec admin "lua floor(0.9)" +exec admin "lua floor(1.1)" + print """ # clean-up after tests """ diff --git a/test/box/test_init.lua b/test/box/test_init.lua index f6cc13dc3de026e9abe0f96a3de4e9e414ae5142..36dbdbba17a24c7b40e60951dc162bee836b30df 100644 --- a/test/box/test_init.lua +++ b/test/box/test_init.lua @@ -1,4 +1,5 @@ -- testing start-up script +floor = require("math").floor -- -- Access to box.cfg from start-up script