Put the following source at the beginning of your source to enable the base dir restriction in lua.
You need
LuaFileSystem installed.
do
local oldOpen = io.open
io.open = function (filename, mode)
require "lfs"
local currentdir=lfs.currentdir()
-- On Windows, wrong drive
if (string.sub(filename,2,2)==':' and string.sub(filename,1,1)~=string.sub(currentdir,1,1)) then
return nil, "access denied"
end
-- If this is no windows drive location and no *nix root -> append it
if (string.sub(filename,2,2)~=':' and string.sub(filename,1,1)~='/') then
filename=currentdir..[[\]]..filename
end
local strlenbefore=string.len(filename)+1
while ( strlenbefore>string.len(filename) ) do
strlenbefore=string.len(filename)
-- Clean on windows from the ...
filename=string.gsub(filename,[[([^%/]+)%\([^%/]+)%\%.%.]],"%1")
--Clean on linux from the ...
filename=string.gsub(filename,[[([^%/]-)%/%.%.]],"")
end
if (string.sub(filename,1,string.len(currentdir))~=currentdir) then
return nil, "access denied"
end
return oldOpen(filename, mode)
end
end
Loading...