Skip to content
Snippets Groups Projects
  1. Dec 29, 2018
  2. Dec 09, 2018
  3. Sep 18, 2018
    • luk3yx's avatar
      Mark 'code' as private as well · 028c290c
      luk3yx authored
      Saves on bandwidth, however the code is still accessible via the formspec.
      028c290c
    • luk3yx's avatar
      Mark LuaController memory as private · 8808bb89
      luk3yx authored
      If LuaControllers handle sensitive information, hacked clients could get this information from the LuaController. Marking the memory as private fixes this and saves a small amount of bandwidth.
      8808bb89
  4. Jul 23, 2018
  5. Jul 18, 2018
  6. Jan 22, 2018
    • 20kdc's avatar
      Improve LuaController security (#393) · 065e8703
      20kdc authored
      Fixes:
      1. Lack of 'safe' on minetest.deserialize usage
      2. String sandbox bypass via (""):evil()
      3. Loss of upcoming digilines messages on server shutdown
      4. LCs failing to show information on some errors
      5. Interrupt IDs as infinite data storage
      065e8703
  7. Jan 13, 2018
    • Christopher Head's avatar
      Limit and optimize digiline_send (#379) · 2b096f05
      Christopher Head authored
      * Close vulnerability and optimize digiline_send
      
      `digiline_send` as it previously existed was vulnerable to a
      time-of-check-to-time-of-use vulnerability in which a table could be
      sent, size-checked, and then modified after the send but before
      delivery. This would allow larger tables to be sent. It was also slow
      because it called `minetest.serialize`. Fix both of these by
      implementing custom message cleanup logic which simultaneously computes
      the message’s cost.
      
      * Clean up interaction with Digilines
      
      Use `minetest.global_exists` to avoid an undefined global variable
      warning when operating a Luacontroller with Digilines not available. Use
      the new `digilines` table in preference to the old `digiline` table.
      
      * Copy received messages
      
      When a Digiline message is received at a Luacontroller, copy it so that
      local modifications made by the Luacontroller code will not modify
      copies of the table that are being passed to other nodes on the Digiline
      network.
      2b096f05
  8. Oct 31, 2017
  9. Oct 18, 2017
  10. Oct 07, 2017
  11. May 08, 2017
  12. Apr 14, 2017
  13. Mar 07, 2017
    • Wuzzy's avatar
      Spell-check and clarify item names · 967bde28
      Wuzzy authored
      * Fix inconsistent insulated mesecon names
      * Clarify lightstone names
      * Rename meselamp to "Mesecon Lamp"
      * Use capitalization "Luacontroller" consistently
      * Cleanup / improvements for logic gate naming
      967bde28
  14. Jan 15, 2017
  15. Dec 28, 2016
    • Jeija's avatar
      Luacontroller: Restrict digiline messages · 703e6fda
      Jeija authored
      Restrict maximum length of messages to 50.000 characters and disable sending functions or table references over the wire. Restrict types of channel variable to string, number or boolean.
      
      The missing length restriction made DoS-like attacks possible by overflowing memory using string concatenation. Thanks to gamemanj for disclosing this issue.
      703e6fda
  16. Aug 16, 2016
  17. May 17, 2016
  18. Apr 26, 2016
  19. Apr 02, 2016
    • Pedro Gimeno's avatar
      Disable JIT optimization for user code and allow string.find in plain mode · b487783c
      Pedro Gimeno authored
      Disabling LuaJIT for user code enables normal working of debug.sethook() even for loops. The drawback is that that code will run more slowly.
      
      The fourth parameter of string.find indicates whether the second parameter should be interpreted literally (true) or as a pattern (false). Allowing patterns enables DoS attacks, but it's possible to
      allow literal matching with little effort, by disallowing the function only if the fourth parameter (plain mode) is not `true`.
      b487783c
  20. Mar 14, 2016
  21. Mar 13, 2016
  22. Jan 02, 2016
  23. Oct 18, 2015
  24. Oct 04, 2015
  25. Dec 20, 2014
  26. Nov 29, 2014
  27. Nov 25, 2014
  28. Nov 23, 2014
  29. Nov 22, 2014
  30. Nov 21, 2014
  31. Oct 07, 2014
    • ShadowNinja's avatar
      Improve the LuaController · bd1766e4
      ShadowNinja authored
      Changes:
        * Stops code after a certain number of instructions.
        * Allows functions, due to instruction counting.
        * Allows loops and goto with non-JIT Lua (LuaJIT doesn't count looping as an instruction, allowing infinite loops), due to instruction counting.
        * Removes string matching functions as they can be slow.
        * Adds some safe functions.
        * Limits the amount of printing that can be done (to prevent console flooding).
        * Code cleanup.
        * More...
      bd1766e4
  32. Apr 20, 2014
  33. Mar 19, 2014
Loading