[0.11.3] Lua leaks computers account name/data path

This subforum contains all the issues which we already resolved.
Plorntus
Burner Inserter
Burner Inserter
Posts: 14
Joined: Mon Nov 24, 2014 10:43 am
Contact:

[0.11.3] Lua leaks computers account name/data path

Post by Plorntus »

Im not terribly good at Lua so I have no idea if this is an issue with how lua is done or if this is an issue with serpent getting the bytecode for a function in a higher context than the mod is run in however:

This is the least amount of code I could get it to work with

Code: Select all

local test = {};
function test:new () 
	return {};
end
function test:print () 
end
local p,s = pcall(load("return _ENV;", nil, "t", { test:new(), test }));
local path = string.match(serpent.line(s), ".-/(.-)|.*")
game.player.print(path);

When it prints out the result of that it gives a string pointing to the path of the mod:

Image

Now, im not sure how "bad" this is or if something else is going on here. I mean its not a major issue, just something that might want to be looked into. I found this whilst debugging a mod which runs lua scripts in computers in game so would be thankful if you didn't just remove pcall or load and could find a different way of sorting this out (if it needs to be).

Thanks!
MF-
Smart Inserter
Smart Inserter
Posts: 1235
Joined: Sun Feb 24, 2013 12:07 am
Contact:

Re: [0.11.3] Lua leaks computers account name/data path

Post by MF- »

I guess that depends on who is able to see such information.
If you use that mod in an MP game, will everyone on the network see?

Hiding this information from mods just in case seems sensible to me
kovarex
Factorio Staff
Factorio Staff
Posts: 8207
Joined: Wed Feb 06, 2013 12:00 am
Contact:

Re: [0.11.3] Lua leaks computers account name/data path

Post by kovarex »

I don't know what exactly is happening there, but it is clearly a bug.
User avatar
DaveMcW
Smart Inserter
Smart Inserter
Posts: 3717
Joined: Tue May 13, 2014 11:06 am
Contact:

Re: [0.11.3] Lua leaks computers account name/data path

Post by DaveMcW »

It's the debug library.

Code: Select all

game.player.print(debug.getinfo(1).source)
Plorntus
Burner Inserter
Burner Inserter
Posts: 14
Joined: Mon Nov 24, 2014 10:43 am
Contact:

Re: [0.11.3] Lua leaks computers account name/data path

Post by Plorntus »

DaveMcW wrote:It's the debug library.

Code: Select all

game.player.print(debug.getinfo(1).source)

Ah, that makes much more sense than the long winded example I had (wasnt sure on the internals so didnt know thats essentially what its doing). Does this mean 'debug' would need to be removed to fix this? As I am currently using debug.sethook to ensure sandboxed scripts inside my mod cant get put in an infinite loop and halt the game.
starxplor
Fast Inserter
Fast Inserter
Posts: 164
Joined: Sun May 18, 2014 11:25 pm
Contact:

Re: [0.11.3] Lua leaks computers account name/data path

Post by starxplor »

If you are worried about a mod having access to its own location in your storage system, I suggest not using that mod.

General rule is not to download anything(not just mods) that you do not trust enough to know where it is.
User avatar
cube
Former Staff
Former Staff
Posts: 1111
Joined: Tue Mar 05, 2013 8:14 pm
Contact:

Re: [0.11.3] Lua leaks computers account name/data path

Post by cube »

This is fixed for 0.11.4. The full file path should not appear anywhere, instead only a logical package name and a path inside that package is used (for example __base__/some_file.lua)
Post Reply

Return to “Resolved Problems and Bugs”