| (5 intermediate revisions by 4 users not shown) | |||
| Line 1: | Line 1: | ||
| + | The following functions are available in foldit Lua V2. Any not listed were excluded because of possible security issues. Documentation for all of these functions can be found on the [http://www.lua.org/manual/5.1/#index Lua Web site]. |
||
| − | Lua comes with some standard libraries that can be included in the distribution. Currently foldit has no support for these standard libraries. |
||
| + | If there is a function that you think should be included that isn't listed, make an argument for it in the foldit Forum. Show citations from the [http://forum.luahub.com/ Lua Forum] describing the implications of including this function, especially that it is safe. |
||
| − | World of Warcraft (WOW) also uses Lua as their scripting language. Since they are far more likely to be hacked than foldit, you can trust that they have carefully examined the function list. You can find the functions that they implemented here: http://www.wowwiki.com/Lua_functions |
||
| − | |||
| − | The following functions should be added to the foldit distribution: |
||
== Standard Functions == |
== Standard Functions == |
||
| + | http://www.lua.org/manual/5.1/manual.html#5 |
||
| ⚫ | |||
| − | The following standard functions should be included or excluded as shown: |
||
| + | * assert |
||
| − | |||
| + | * error |
||
| − | * _G: safe to include, doesn't expose anything harmful, useful with getfenv/setfenv |
||
| + | * ipairs |
||
| ⚫ | |||
| + | * next |
||
| − | * assert: include, good for error control (used in WOW) |
||
| + | * pairs |
||
| − | * collectgarbage: include, useful for large, intensive scripts (used in WOW) |
||
| + | * pcall |
||
| − | * dofile: potentially dangerous and could be very useful, allows executing a script mid-script (like calling a 'blue fuse script' during a 'rebuild segment' script), in the C bind, don't allow reading files outside script directory |
||
| + | * print (special implementation in foldit) |
||
| − | * error: include, like assert, useful for error control (used in WOW) |
||
| + | * select |
||
| − | * getfenv: (low priority) include, good for multilevel scripting (used in WOW) |
||
| + | * tonumber |
||
| − | * getmetatable: (low priority) include, useful (used in WOW) |
||
| + | * tostring |
||
| − | * ipairs: (high priority) include include include include ... and include (used in WoW) |
||
| + | * type |
||
| − | * load: this should be skipped, loadfile or require and dofile would replace its functionality in a more friendly manner, useful for hiding functions or obfusication |
||
| + | * unpack |
||
| − | * loadfile: potentially dangerous and very useful, used in WOW as 'include' from their addon definition, in the C bind, don't allow reading files outside script directory |
||
| + | * xpcall |
||
| − | * loadstring: see loadfile, include (used in WOW) |
||
| − | * module: ? ??? |
||
| − | * next: (high priority) include, very useful (used in WOW) |
||
| − | * pairs: (high priority) include, include, include (used in WOW) |
||
| − | * pcall: (low priority) include, very useful for error control (used in WOW) |
||
| − | * print: already implemented |
||
| − | * rawequal: (low priority) safe, can be included, roughly it can be said to be a 'ignore any special stuff, is X == Y', useful with metatables |
||
| − | * rawget: (low priority) safe, can be included, roughly equiv to 'ignore any special stuff, what is X', useful with metatables |
||
| − | * rawset: (low priority) safe, can be included, roughly equiv to 'ignore any special stuff, X=Y', useful with metatables |
||
| − | * require: potentially dangerous and could be very useful, allows making a script need another script to function, in the C bind, don't allow reading files outside script directory, and change the C to only allow lua files |
||
| − | * select: include (used in WOW) |
||
| − | * setfenv: (low priority) include (used in WOW) |
||
| − | * setmetatable: (low priority) include (used in WOW) |
||
| − | * tonumber: (high priority) include, extremely useful (used in WOW) |
||
| − | * tostring: (high priority) include, extremely useful (used in WOW) |
||
| − | * type: (high priority) include, helps with above two (used in WOW) |
||
| − | * unpack: (high priority) include, very useful with ... args (used in WOW) easily done in lua without C bind, but C is MUCH faster |
||
| − | * xpcall: (low priority) include (used in WOW) |
||
| − | * break: (high priority) (non-standard, very common added function, patches abound) potentially VERY useful, completely safe, when called it exits a loop (while, for) chunk |
||
| − | |||
| − | == Coroutine Functions == |
||
| − | |||
| − | The coroutine functions can be excluded from the distribution. Very limited usage, as these control multithreading, and only one 'thing' can happen at a time. |
||
| − | |||
| − | * coroutine.create: exclude |
||
| − | * coroutine.resume: exclude |
||
| − | * coroutine.running: exclude |
||
| − | * coroutine.status: exclude |
||
| − | * coroutine.wrap: exclude |
||
| − | * coroutine.yield: exclude |
||
| − | |||
| − | == Debug Functions == |
||
| − | |||
| − | These debug functions can be excluded from being able to be called by scripts. However, they might be used by the foldit user interface. Having a scripting debugger would be a useful addition, allowing stepping through the code a line at a time. This is, however, a lower priority than many other things. |
||
| − | |||
| − | * debug.debug: exclude |
||
| − | * debug.getfenv: exclude |
||
| − | * debug.gethook: exclude |
||
| − | * debug.getinfo: exclude |
||
| − | * debug.getlocal: exclude |
||
| − | * debug.getmetatable: exclude |
||
| − | * debug.getregistry: exclude |
||
| − | * debug.getupvalue: exclude |
||
| − | * debug.setfenv: exclude |
||
| − | * debug.sethook: exclude |
||
| − | * debug.setlocal: exclude |
||
| − | * debug.setmetatable: exclude |
||
| − | * debug.setupvalue: exclude |
||
| − | * debug.traceback: exclude |
||
| − | |||
| − | == File and IO Functions == |
||
| − | |||
| − | '''<u>These functions, while useful, make foldit a potential vector for numerous security problems.</u>''' The only way they should be added to the game is if they are limited to a reading files from particular directory on the disk. Any function that is able to write to the disk is excluded, unless severely restricted. Note that just being able to write an arbitrary file to a disk can be used to write over a system file. Probably better to just exclude them altogether. Some foldit functions might allow a very limited set of file operations to one directory on the disk. |
||
| − | |||
| − | * file:close: exclude |
||
| − | * file:flush: exclude |
||
| − | * file:lines: exclude |
||
| − | * file:read: exclude |
||
| − | * file:seek: exclude |
||
| − | * file:setvbuf: exclude |
||
| − | * file:write: exclude |
||
| − | |||
| − | * io.close: exclude |
||
| − | * io.flush: exclude |
||
| − | * io.input: exclude |
||
| − | * io.lines: exclude |
||
| − | * io.open: exclude |
||
| − | * io.output: exclude |
||
| − | * io.popen: exclude |
||
| − | * io.read: exclude |
||
| − | * io.stderr: exclude |
||
| − | * io.stdin: exclude |
||
| − | * io.stdout: exclude |
||
| − | * io.tmpfile: exclude |
||
| − | * io.type: exclude |
||
| − | * io.write: exclude |
||
== Math Functions == |
== Math Functions == |
||
| + | http://www.lua.org/manual/5.1/manual.html#5.6 |
||
| + | * math.abs |
||
| − | We need the entire Lua standard math library to be added to the distribution. This should be entirely safe. WOW includes all these functions, although they provide wrappers that accept degrees rather than radians. |
||
| + | * math.acos |
||
| − | |||
| + | * math.asin |
||
| − | Most can already be performed without enough basic math, however exposing functions tied to their C counterparts would be much faster with higher accuracy. |
||
| + | * math.atan |
||
| − | |||
| + | * math.atan2 |
||
| − | |||
| + | * math.ceil |
||
| − | |||
| − | * math. |
+ | * math.cos |
| − | * math. |
+ | * math.cosh |
| − | * math. |
+ | * math.deg |
| − | * math. |
+ | * math.exp |
| − | * math. |
+ | * math.floor |
| − | * math. |
+ | * math.fmod |
| − | * math. |
+ | * math.frexp |
| − | * math. |
+ | * math.huge |
| − | * math. |
+ | * math.ldexp |
| − | * math. |
+ | * math.log |
| − | * math. |
+ | * math.log10 |
| − | * math. |
+ | * math.max |
| − | * math. |
+ | * math.min |
| − | * math. |
+ | * math.modf |
| − | * math. |
+ | * math.pi |
| − | * math. |
+ | * math.pow |
| − | * math. |
+ | * math.rad |
| − | * math. |
+ | * math.random |
| − | * math. |
+ | * math.randomseed |
| − | * math. |
+ | * math.sin |
| − | * math. |
+ | * math.sinh |
| − | * math. |
+ | * math.sqrt |
| − | * math. |
+ | * math.tan |
| − | * math. |
+ | * math.tanh |
| − | * math.randomseed: include |
||
| − | * math.sin: include |
||
| − | * math.sinh: include |
||
| − | * math.sqrt: include |
||
| − | * math.tan: include |
||
| − | * math.tanh: include |
||
== OS Functions == |
== OS Functions == |
||
| + | * os.clock |
||
| − | Some of these are very dangerous, but others are completely harmless and useful. |
||
| + | * os.date |
||
| − | |||
| − | * os. |
+ | * os.difftime |
| + | * os.time |
||
| − | * os.date: include (used in WOW as date instead of os.date) |
||
| − | * os.difftime: include |
||
| − | * os.execute: exclude |
||
| − | * os.exit: exclude |
||
| − | * os.getenv: exclude |
||
| − | * os.remove: exclude |
||
| − | * os.rename: exclude |
||
| − | * os.setlocale: exclude |
||
| − | * os.time: include (used in WOW as time instead of os.time) |
||
| − | * os.tmpname: exclude |
||
| − | |||
| − | == Package Functions == |
||
| − | |||
| − | The package functions should be selectively included to allow libraries of functions. They should only allow lua packages from a certain directory on the disk. By default lua allows packages written in C and from anywhere on the disk. This should be prohibited. An expansion of this section is forthcoming detailing what changes need to be made and what functions to include and exclude. |
||
| − | |||
| − | There are some additional issues to think about. If a recipe relies on a package, when the recipe is downloaded from the web site, what is the mechanism that the package is too? What if two different recipes rely on two different versions of the same package that are incompatible? Some required naming conventions for the package files might be enforced, with something like the id number from the web site embedded into the file name when it is downloaded. |
||
| − | |||
| − | * package.cpath: ? |
||
| − | * package.loaded: ? |
||
| − | * package.loaders: ? |
||
| − | * package.loadlib: ? |
||
| − | * package.path: ? |
||
| − | * package.preload: ? |
||
| − | * package.seeall: ? |
||
== String Functions == |
== String Functions == |
||
| + | * string.byte |
||
| − | We need the entire Lua standard string library to be added to the distribution. This should be entirely safe. |
||
| + | * string.char |
||
| − | |||
| + | * string.dump |
||
| − | * string.byte: include (used in WOW as strbyte instead of string.byte) |
||
| + | * string.find |
||
| − | * string.char: include (used in WOW as strchar instead of string.char) |
||
| − | * string. |
+ | * string.format |
| + | * string.gmatch |
||
| − | * string.find: include (used in WOW as strfind instead inf string.find) |
||
| + | * string.gsub |
||
| − | * string.format: include (used in WOW as format instead of string.format) |
||
| − | * string. |
+ | * string.len |
| + | * string.lower |
||
| − | * string.gsub: include (used in WOW as gsub instead of string.gsub) |
||
| + | * string.match |
||
| − | * string.len: include (used in WOW as strlen instead of string.len) |
||
| + | * string.rep |
||
| − | * string.lower: include (used in WOW as strlower instead of string.lower) |
||
| + | * string.reverse |
||
| − | * string.match: include (used in WOW as strmatch instead of string.match) |
||
| + | * string.sub |
||
| − | * string.rep: include (used in WOW as strrep instead of string.rep) |
||
| + | * string.upper |
||
| − | * string.reverse: include (used in WOW as strrev instead of string.reverse) |
||
| − | * string.sub: include (used in WOW as strsub instead of string.sub) |
||
| − | * string.upper: include (used in WOW as strupper instead of string.upper) |
||
== Table Functions == |
== Table Functions == |
||
| + | * table.concat |
||
| − | We need the Lua standard table library to be added to the distribution. This is no more dangerous than other parts of Lua, where a runaway or malicious script can eat all available memory. |
||
| + | * table.insert |
||
| − | |||
| − | * table. |
+ | * table.maxn |
| + | * table.remove |
||
| − | * table.insert: include (used in WOW as tinsert instead of table.insert) |
||
| − | * table. |
+ | * table.sort |
| + | * table.unpack |
||
| − | * table.remove: include (used in WOW as tremove instead of table.remove) |
||
| + | [[Category:Script tutorial]] |
||
| − | * table.sort: include (used in WOW as sort instead of table.sort) |
||
| + | [[Category:Script tutorial]] |
||
| − | * table.unpack: include (converts a table into an array that can be used as the argument of foldit functions that accept a list of segments, like get_aa) |
||
| − | |||
| − | == Lua and LuaL Functions == |
||
| − | |||
| − | The Lua and LuaL functions should be excluded. |
||
Latest revision as of 06:30, 6 April 2012
The following functions are available in foldit Lua V2. Any not listed were excluded because of possible security issues. Documentation for all of these functions can be found on the Lua Web site.
If there is a function that you think should be included that isn't listed, make an argument for it in the foldit Forum. Show citations from the Lua Forum describing the implications of including this function, especially that it is safe.
Standard Functions[]
http://www.lua.org/manual/5.1/manual.html#5
- _VERSION
- assert
- error
- ipairs
- next
- pairs
- pcall
- print (special implementation in foldit)
- select
- tonumber
- tostring
- type
- unpack
- xpcall
Math Functions[]
http://www.lua.org/manual/5.1/manual.html#5.6
- math.abs
- math.acos
- math.asin
- math.atan
- math.atan2
- math.ceil
- math.cos
- math.cosh
- math.deg
- math.exp
- math.floor
- math.fmod
- math.frexp
- math.huge
- math.ldexp
- math.log
- math.log10
- math.max
- math.min
- math.modf
- math.pi
- math.pow
- math.rad
- math.random
- math.randomseed
- math.sin
- math.sinh
- math.sqrt
- math.tan
- math.tanh
OS Functions[]
- os.clock
- os.date
- os.difftime
- os.time
String Functions[]
- string.byte
- string.char
- string.dump
- string.find
- string.format
- string.gmatch
- string.gsub
- string.len
- string.lower
- string.match
- string.rep
- string.reverse
- string.sub
- string.upper
Table Functions[]
- table.concat
- table.insert
- table.maxn
- table.remove
- table.sort
- table.unpack