search

gilzoide / godot-lua-pluginscript

Godot PluginScript for the Lua language, currently based on LuaJIT's FFI
https://gilzoide.github.io/godot-lua-pluginscript/topics/README.md.html
MIT License
300 stars 21 forks source link

Runtime scripting #26

Closed Frontrider closed 2 years ago

Frontrider commented 2 years ago

Can I use it at runtime to execute lua scripts? (without compromising the rest of the application)

gilzoide commented 2 years ago

My understanding of your question is that it's about executing Lua scripts that are generated at runtime, for example written by users. I'll answer based on that assumption, please let me know if it's not about that.

So the short answer is yes, absolutely! If you want to execute arbitrary scripts and don't want to create your own scripting language/runtime, Lua is the first tool that comes to mind.

If using Lua PluginScript, you have a full LuaJIT runtime embedded in Godot, so you can use the customary functions load and loadfile to load arbitrary code, then pcall the functions to run them (or just call directly, but protecting the calls is advised).

If you look up the keywords "Lua" and "sandbox", you'll find a lot of content on how to protect code execution from accessing unsafe stuff. It's hard to do it 100%, but depending on your needs, it may be easy enough to make a decent sandbox that won't break the game's code. Maybe it will be vulnerable to inifinite loops and freeze the app in the user's machine or allocate too much memory and crash, these are some hard ones to sandbox. But if it can't mess with the game code/functions/variables, might be good enough.

Frontrider commented 2 years ago

Yap, that is exactly what I wanted to know. Thank you.

Frontrider commented 2 years ago

I could suggest spelling this out in the first paragraph, so it becomes 1000% obvious.

gilzoide commented 2 years ago

No problem! If you manage to make a project using some kind of runtime generated (either by users or not) script loading, I'm interested in knowing the results ^^

Just as a side note, Lua PluginScript itself uses loadstring/load for loading and running Lua scripts in Godot. It doesn't do any sandboxing because this would limit what devs can do while implementing games/apps. The only changes to the environment are additional globals (like the GD table and types like Vector2 and PoolStringArray) and an __index metamethod for the global _G table so that it can find Godot classes and singletons.