lua-http icon indicating copy to clipboard operation
lua-http copied to clipboard

allow to use a lua without debug library

Open fperrad opened this issue 4 years ago • 4 comments

the use of debug library could be not safe.

this commit protects two calls of debug

there are two other occurences of debug:

  • in http/util/lua, which concerns only PUC Lua 5.1, so it is ok for LuaJIT, Lua 5.2, 5.3 & 5.4
  • in spec/helper.lua, but busted uses heavily debug

fperrad avatar Jun 04 '21 19:06 fperrad

This library provides the functionality of the debug interface (§4.7) to Lua programs. You should exert care when using this library. Several of its functions violate basic assumptions about Lua code (e.g., that variables local to a function cannot be accessed from outside; that userdata metatables cannot be changed by Lua code; that Lua programs do not crash) and therefore can compromise otherwise secure code. Moreover, some functions in this library may be slow.

at least, this library is not recommended.

I want run code in production with a Lua interpreter compiled without this library debug

fperrad avatar Jun 09 '21 12:06 fperrad

not with the test suite using busted which depends on debug.

fperrad avatar Jun 09 '21 16:06 fperrad

see https://gist.github.com/fperrad/694cb6d1c851a388aebe939ff9f393bb

fperrad avatar Jun 09 '21 17:06 fperrad

not with the test suite using busted which depends on debug.

I believe busted allows you to modify globals during a test, and will restore them afterwards. You should be able to run debug = nil during a test to remove it?

daurnimator avatar Jun 10 '21 14:06 daurnimator