2010/3/17 pepeto <no-reply.invalid-addr...@gna.org>: > > Update of bug #15624 (project freeciv): > > Status: None => Ready For Test > Assigned to: None => pepeto > Planned Release: => 2.2.1, 2.3.0 > > > _______________________________________________________ > > Reply to this item at: > > <http://gna.org/bugs/?15624> >
Hi, It would be great if someone else who has looked/thought about our scripting support before would comment on this (hence RFC: Request for Comment). While not a remote hole, it is a big security issue IMO, since Freeciv 2.1. Also if one wants to plug this kind of hole, sadly only a solution without holes is going to work. I will gladly be responsible for the solution but it makes it easier if someone else could comment on it. I know that we have no one of real Lua expertise and we can not feel totally confortable with security solutions worked on by relative amateurs (me). This can be a start also of course, I can try to follow it up more closely. We can document our approach and maybe get feedback from outside the project. Also, if this goes in as is we can call it something like "Execute Lua scripts in a sanitized environment" since sandboxing normally means even larger measures when it comes to servers, for example restricting the number of instructions to guard against infinite loops and that kind of "DoS" attacks (This is something we should be able to defend against as well, but it is not nearly as important). Thanks for any comments. ulrik _______________________________________________ Freeciv-dev mailing list Freeciv-dev@gna.org https://mail.gna.org/listinfo/freeciv-dev
