mid/k4
1
0
Fork 0
Code Actions Releases Wiki Activity

Secure module names

Browse Source
This commit is contained in:
mid 2025-02-09 22:22:59 +02:00
parent 2cae13dc2d
commit 8b359412f2
1 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/luaapi.c
View File

@ -1427,7 +1427,29 @@ static struct Module {
int ref; int ref;
} *modules; } *modules;
static int luaapi_require(lua_State *L) { static int luaapi_require(lua_State *L) {
const char *name = lua_tostring(L, 1); char *name = strdup(lua_tostring(L, 1));
size_t nameLen = strlen(name);
while(*name == '.' && nameLen) {
memmove(name, name + 1, --nameLen);
}
for(int i = 1; i < nameLen;) {
if(name[i] == '.' && name[i - 1] == '.') {
memmove(name + i + 1, name + i, --nameLen - i);
} else i++;
}
for(int i = 0; i < nameLen;) {
if(!isalpha(name[i]) && !isdigit(name[i]) && name[i] != '_' && name[i] != '-') {
memmove(name + i + 1, name + i, --nameLen - i);
} else i++;
}
if(nameLen == 0) {
free(name);
return 0;
}
for(size_t i = 0; i < moduleCount; i++) { for(size_t i = 0; i < moduleCount; i++) {
if(!strcmp(modules[i].name, name)) { if(!strcmp(modules[i].name, name)) {