moai/moai-dev — Issue #96: Suggestion:  a secure require() for moai cloud ( with code attached )
Author: pygy
Created: 2012-01-14 18:41:42+00:00
State: open

Require is very convenient.

The following code implements a secure require() functionality. Actually, you expose the real require function in the sandbox, but only provide a single, secure loader. This is adapted from code I wrote for LÖVE.

The 'dot notation' is supported. The root directory, 'lib' and 'Library' are added to the standard path by default, but the user can add ore if he wants to.

`require'module.submodule'` will search the path for `module/submodule. lua` and `module/submodule/init.lua`. C libraries are not supported.

--------------------------------------------------------------------------------
-- Copyright P-Y Gérardy,
-- Released under the Romantic WTF Public License, see below.
--------------------------------------------------------------------------------
-- Loader.lua
-- Use Loader.addPath( ... ) to add one or more directories to the path
-- (no terminal slash).
-- Note that paths with forward slashes work on Windows NT4+
-- (Win NT4, 2000, XP, Server 2003 and 2008, Vista and 7).
-- So long, 9x users! (Does LÖVE even work on Win 9x?)

local loveLibPath = ""

local
function search (modname)
-- adapted (actually, almost copied verbatim) from PiL 2nd ed.
modname = string.gsub( modname, "%.", "/" )
for c in string.gmatch( loveLibPath, "[^;]+" ) do
local fname = string.gsub(c, "?", modname)
if love.filesystem.exists (fname) then
return fname
end
end
return nil -- not found
end

uploadedThroughZipFile = {
[["some.path"]] = true,
[["some.other.path"]] = true,
}

local
function moaiLoader (modname)
local path = search( modname )
if path and uploadedThrougZipFile[path] then
return loadstring( moai.code.find_file( path ) )
else
return false
end
end

package.loaders={moaiLoader} -- wipe the standard loaders

local l={} -- doesn't have to be public
function l.addPath (...)
for _, path in pairs{...} do
loveLibPath = loveLibPath .. path .. "/?/init.lua;" .. path .. "/?.lua;"
end
end

l.addPath("","lib","Library")

return l

--[[----------------------------------------------------------------------------
The Romantic WTF public license.
--------------------------------
a.k.a. version "<3" or simply v3

Dear user,

This short piece of code

\
'.,__
\ /
'/,__
/
/
/
has been / released
- - - - - - - - - - - - - - - -
under the Romantic WTF Public License.
- - - - - - - - - - -',' - - - - - - - - - -
I hereby grant you an irrevocable license to
- - - - - - - - - - - - - - - - - - - - -
do what the gentle caress you want to
- - - - - - - - - - - - - - -
with this little
- - - - - - - -
/ snippet.
/ - - - -
/ Love,
# / -
## / ## ,
#######
#####
###
#

-- Pierre-Yves.

P.S.: Even though I poured my heart into this work,
I _cannot_ provide any warranty regarding
its fitness for _any_ purpose. You
acknowledge that I will not be held liable
for any damage its use could incur.

]]------------------------------------------------------------------------------