Re: [Monotone-devel] Why are io.popen() and os.execute() disabled again?

[Timothy Brownawell]

On 05/10/2010 06:40 PM, Thomas Keller wrote:
> Hi!
>
> I'm in the process of improving our Lua documentation a bit, also in
> respect to the recent changes in print() / io.write() behaviour and I
> wanted to include a sentence or two about the above mentioned disabled
> functions. And then I started wondering why we disable these two
> functions at all - especially since we replace them with two other
> custom calls...
>
> I know Graydon committed this initially in
> c6b551a24d7e2fd97d87aace1f03cabece12f8b7 back in 2005 and I found a
> reference on the list
> (http://www.mail-archive.com/address@hidden/msg02464.html),
> but both don't bring me further.
>
> Can anybody please shed light into this issue?

The changelog there says "disable bad lua functions from monotone, not 
lua library", and it also touches lua/liolib.c.

What it removes there is:
|   -
|   -  /*
|   -    monotone specific: we're disabling io_popen here because
|   -    it calls shell, and is thereby a horrible security hole in
|   -    waiting.
|   -  */
|   -
|   -  /*   {"popen", io_popen}, */
|   -

...which first showed up in 73c79720e2948734647b5e4393c1cfbca0b1d073, on 
2/3/2005.

So that means the purpose is to not have to worry about things like 
properly quoting any evil shell metacharacters in the filenames you give 
your external merger.

--
Timothy

Free public monotone hosting: http://mtn-host.prjek.net