Fixed a potential way to escape the Lua Plugin sandbox (#5846)

2025-01-22 02:35:52 +01:00
parent a9984b63e1
commit ea02a42162
4 changed files with 11 additions and 0 deletions
@@ -244,6 +244,9 @@ void PluginController::initSol(sol::state_view &lua, Plugin *plugin)
    io.set_function("write", &lua::api::io_write);
    io.set_function("popen", &lua::api::io_popen);
    io.set_function("tmpfile", &lua::api::io_tmpfile);
+
+    sol::table package = g["package"];
+    package.set_function("loadlib", &lua::api::package_loadlib);
 }

 void PluginController::load(const QFileInfo &index, const QDir &pluginDir,