{"action":"created","issue":{"url":"https://api.github.com/repos/minetest/minetest/issues/1606","labels_url":"https://api.github.com/repos/minetest/minetest/issues/1606/labels{/name}","comments_url":"https://api.github.com/repos/minetest/minetest/issues/1606/comments","events_url":"https://api.github.com/repos/minetest/minetest/issues/1606/events","html_url":"https://github.com/minetest/minetest/pull/1606","id":42103518,"number":1606,"title":"Add mod security","user":{"login":"ShadowNinja","id":3399154,"avatar_url":"https://avatars.githubusercontent.com/u/3399154?v=3","gravatar_id":"","url":"https://api.github.com/users/ShadowNinja","html_url":"https://github.com/ShadowNinja","followers_url":"https://api.github.com/users/ShadowNinja/followers","following_url":"https://api.github.com/users/ShadowNinja/following{/other_user}","gists_url":"https://api.github.com/users/ShadowNinja/gists{/gist_id}","starred_url":"https://api.github.com/users/ShadowNinja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ShadowNinja/subscriptions","organizations_url":"https://api.github.com/users/ShadowNinja/orgs","repos_url":"https://api.github.com/users/ShadowNinja/repos","events_url":"https://api.github.com/users/ShadowNinja/events{/privacy}","received_events_url":"https://api.github.com/users/ShadowNinja/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/minetest/minetest/labels/@%20Script%20API","name":"@ Script API","color":"009800"},{"url":"https://api.github.com/repos/minetest/minetest/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/minetest/minetest/labels/Incompatible%20change","name":"Incompatible change","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":56,"created_at":"2014-09-06T00:28:44Z","updated_at":"2015-02-12T06:52:18Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/minetest/minetest/pulls/1606","html_url":"https://github.com/minetest/minetest/pull/1606","diff_url":"https://github.com/minetest/minetest/pull/1606.diff","patch_url":"https://github.com/minetest/minetest/pull/1606.patch"},"body":"This preserves compatibility with most mods.\r\n\r\nThings that you can't do anymore:\r\n  * Access any files not in the mod or world path.\r\n  * Run Lua bytecode (it's insecure).\r\n  * Use `require()`, `package.loadlib()` and the like (they can load C modules).\r\n  * Use `os.execute()` or `io.popen()` to run shell commands.\r\n  * Use the registry (insecure env is stored there).\r\n  * Get/set user values (may be unsafe, Lua 5.2 feature anyway).\r\n  * Get locals of the caller with the debug library (can be used to steal an insecure env).\r\n\r\nYou can do just about anything else, including using `getfenv` / `setfenv` and `getmetatable` / `setmetatable` (these functions are only dangerous if the sandbox is created from Lua).\r\n\r\nMods that **NEED** access to insecure functions (very few do) can use `minetest.request_insecure_environment()` to get the original globals table with all insecure functions included.  This function will only work if the user adds the mod to their `secure_trusted_mods` setting or has mod security disabled.\r\n\r\nI'd appreciate any comments on other possible security holes.\r\n"},"comment":{"url":"https://api.github.com/repos/minetest/minetest/issues/comments/74025784","html_url":"https://github.com/minetest/minetest/pull/1606#issuecomment-74025784","issue_url":"https://api.github.com/repos/minetest/minetest/issues/1606","id":74025784,"user":{"login":"nerzhul","id":119752,"avatar_url":"https://avatars.githubusercontent.com/u/119752?v=3","gravatar_id":"","url":"https://api.github.com/users/nerzhul","html_url":"https://github.com/nerzhul","followers_url":"https://api.github.com/users/nerzhul/followers","following_url":"https://api.github.com/users/nerzhul/following{/other_user}","gists_url":"https://api.github.com/users/nerzhul/gists{/gist_id}","starred_url":"https://api.github.com/users/nerzhul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nerzhul/subscriptions","organizations_url":"https://api.github.com/users/nerzhul/orgs","repos_url":"https://api.github.com/users/nerzhul/repos","events_url":"https://api.github.com/users/nerzhul/events{/privacy}","received_events_url":"https://api.github.com/users/nerzhul/received_events","type":"User","site_admin":false},"created_at":"2015-02-12T06:52:18Z","updated_at":"2015-02-12T06:52:18Z","body":"I also approve this modification. Could you rebase your commits ?"}}