{"action":"created","issue":{"url":"https://api.github.com/repos/minetest/minetest/issues/1606","labels_url":"https://api.github.com/repos/minetest/minetest/issues/1606/labels{/name}","comments_url":"https://api.github.com/repos/minetest/minetest/issues/1606/comments","events_url":"https://api.github.com/repos/minetest/minetest/issues/1606/events","html_url":"https://github.com/minetest/minetest/pull/1606","id":42103518,"number":1606,"title":"Add mod security","user":{"login":"ShadowNinja","id":3399154,"avatar_url":"https://avatars.githubusercontent.com/u/3399154?v=3","gravatar_id":"","url":"https://api.github.com/users/ShadowNinja","html_url":"https://github.com/ShadowNinja","followers_url":"https://api.github.com/users/ShadowNinja/followers","following_url":"https://api.github.com/users/ShadowNinja/following{/other_user}","gists_url":"https://api.github.com/users/ShadowNinja/gists{/gist_id}","starred_url":"https://api.github.com/users/ShadowNinja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ShadowNinja/subscriptions","organizations_url":"https://api.github.com/users/ShadowNinja/orgs","repos_url":"https://api.github.com/users/ShadowNinja/repos","events_url":"https://api.github.com/users/ShadowNinja/events{/privacy}","received_events_url":"https://api.github.com/users/ShadowNinja/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/minetest/minetest/labels/@%20Script%20API","name":"@ Script API","color":"009800"},{"url":"https://api.github.com/repos/minetest/minetest/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/minetest/minetest/labels/Incompatible%20change","name":"Incompatible change","color":"eb6420"},{"url":"https://api.github.com/repos/minetest/minetest/labels/rebase%20needed","name":"rebase needed","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/minetest/minetest/milestones/5","html_url":"https://github.com/minetest/minetest/milestones/0.5","labels_url":"https://api.github.com/repos/minetest/minetest/milestones/5/labels","id":704183,"number":5,"title":"0.5","description":"This milestone will break compatibility.\r\nAny pull requests or feature requests valuable but not implementable in a compatible way should be added for 0.5.","creator":{"login":"sapier","id":984363,"avatar_url":"https://avatars.githubusercontent.com/u/984363?v=3","gravatar_id":"","url":"https://api.github.com/users/sapier","html_url":"https://github.com/sapier","followers_url":"https://api.github.com/users/sapier/followers","following_url":"https://api.github.com/users/sapier/following{/other_user}","gists_url":"https://api.github.com/users/sapier/gists{/gist_id}","starred_url":"https://api.github.com/users/sapier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sapier/subscriptions","organizations_url":"https://api.github.com/users/sapier/orgs","repos_url":"https://api.github.com/users/sapier/repos","events_url":"https://api.github.com/users/sapier/events{/privacy}","received_events_url":"https://api.github.com/users/sapier/received_events","type":"User","site_admin":false},"open_issues":17,"closed_issues":7,"state":"open","created_at":"2014-06-28T09:37:45Z","updated_at":"2015-04-05T07:28:36Z","due_on":null,"closed_at":null},"comments":69,"created_at":"2014-09-06T00:28:44Z","updated_at":"2015-05-07T16:38:09Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/minetest/minetest/pulls/1606","html_url":"https://github.com/minetest/minetest/pull/1606","diff_url":"https://github.com/minetest/minetest/pull/1606.diff","patch_url":"https://github.com/minetest/minetest/pull/1606.patch"},"body":"This preserves compatibility with most mods.\r\n\r\nThings that you can't do anymore:\r\n  * Access any files not in the mod or world path.\r\n  * Run Lua bytecode (it's insecure).\r\n  * Use `require()`, `package.loadlib()` and the like (they can load C modules).\r\n  * Use `os.execute()` or `io.popen()` to run shell commands.\r\n  * Use the registry (insecure env is stored there).\r\n  * Get/set user values (may be unsafe, Lua 5.2 feature anyway).\r\n  * Get locals of the caller with the debug library (can be used to steal an insecure env).\r\n\r\nYou can do just about anything else, including using `getfenv` / `setfenv` and `getmetatable` / `setmetatable` (these functions are only dangerous if the sandbox is created from Lua).\r\n\r\nMods that **NEED** access to insecure functions (very few do) can use `minetest.request_insecure_environment()` to get the original globals table with all insecure functions included.  This function will only work if the user adds the mod to their `secure_trusted_mods` setting or has mod security disabled.\r\n\r\nI'd appreciate any comments on other possible security holes.\r\n"},"comment":{"url":"https://api.github.com/repos/minetest/minetest/issues/comments/99932465","html_url":"https://github.com/minetest/minetest/pull/1606#issuecomment-99932465","issue_url":"https://api.github.com/repos/minetest/minetest/issues/1606","id":99932465,"user":{"login":"rubenwardy","id":2122943,"avatar_url":"https://avatars.githubusercontent.com/u/2122943?v=3","gravatar_id":"","url":"https://api.github.com/users/rubenwardy","html_url":"https://github.com/rubenwardy","followers_url":"https://api.github.com/users/rubenwardy/followers","following_url":"https://api.github.com/users/rubenwardy/following{/other_user}","gists_url":"https://api.github.com/users/rubenwardy/gists{/gist_id}","starred_url":"https://api.github.com/users/rubenwardy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rubenwardy/subscriptions","organizations_url":"https://api.github.com/users/rubenwardy/orgs","repos_url":"https://api.github.com/users/rubenwardy/repos","events_url":"https://api.github.com/users/rubenwardy/events{/privacy}","received_events_url":"https://api.github.com/users/rubenwardy/received_events","type":"User","site_admin":false},"created_at":"2015-05-07T16:38:09Z","updated_at":"2015-05-07T16:38:09Z","body":"Thanks\r\n\r\nhttp://irc.minetest.ru/minetest/2015-05-07#i_4242286\r\nhttp://sprunge.us/SHMg?diff"}}