search

daurnimator / lua-http

HTTP Library for Lua. Supports HTTP(S) 1.0, 1.1 and 2.0; client and server.
https://daurnimator.github.io/lua-http/
MIT License
778 stars 80 forks source link

allow to use a lua without debug library #190

Open fperrad opened 3 years ago

fperrad commented 3 years ago

the use of debug library could be not safe.

this commit protects two calls of debug

there are two other occurences of debug:

fperrad commented 3 years ago

This library provides the functionality of the debug interface (§4.7) to Lua programs. You should exert care when using this library. Several of its functions violate basic assumptions about Lua code (e.g., that variables local to a function cannot be accessed from outside; that userdata metatables cannot be changed by Lua code; that Lua programs do not crash) and therefore can compromise otherwise secure code. Moreover, some functions in this library may be slow.

at least, this library is not recommended.

I want run code in production with a Lua interpreter compiled without this library debug

fperrad commented 3 years ago

not with the test suite using busted which depends on debug.

fperrad commented 3 years ago

see https://gist.github.com/fperrad/694cb6d1c851a388aebe939ff9f393bb

daurnimator commented 3 years ago

not with the test suite using busted which depends on debug.

I believe busted allows you to modify globals during a test, and will restore them afterwards. You should be able to run debug = nil during a test to remove it?