diff options
author | Jeija <norrepli@gmail.com> | 2016-02-25 10:22:54 +0100 |
---|---|---|
committer | est31 <MTest31@outlook.com> | 2016-03-03 22:42:00 +0100 |
commit | 1100a5d614c2eaf8e1c4f3adbc70b477e01a405c (patch) | |
tree | 0ae9d655072eb3acda8a8f2985cc086522a11a0f /src/script/lua_api | |
parent | 7bcbc0105b3e67b7e066be6fd77775769cffdd16 (diff) | |
download | minetest-1100a5d614c2eaf8e1c4f3adbc70b477e01a405c.tar.gz minetest-1100a5d614c2eaf8e1c4f3adbc70b477e01a405c.tar.bz2 minetest-1100a5d614c2eaf8e1c4f3adbc70b477e01a405c.zip |
Require minetest.request_http_api to be called from the mod's main scope
Fixes #3764
Diffstat (limited to 'src/script/lua_api')
-rw-r--r-- | src/script/lua_api/l_http.cpp | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/src/script/lua_api/l_http.cpp b/src/script/lua_api/l_http.cpp index b0357e3e0..8bd39b6ed 100644 --- a/src/script/lua_api/l_http.cpp +++ b/src/script/lua_api/l_http.cpp @@ -23,6 +23,7 @@ with this program; if not, write to the Free Software Foundation, Inc., #include "lua_api/l_http.h" #include "httpfetch.h" #include "settings.h" +#include "debug.h" #include "log.h" #include <algorithm> @@ -130,11 +131,27 @@ int ModApiHttp::l_request_http_api(lua_State *L) { NO_MAP_LOCK_REQUIRED; + // We have to make sure that this function is being called directly by + // a mod, otherwise a malicious mod could override this function and + // steal its return value. + lua_Debug info; + + // Make sure there's only one item below this function on the stack... + if (lua_getstack(L, 2, &info)) { + return 0; + } + FATAL_ERROR_IF(!lua_getstack(L, 1, &info), "lua_getstack() failed"); + FATAL_ERROR_IF(!lua_getinfo(L, "S", &info), "lua_getinfo() failed"); + + // ...and that that item is the main file scope. + if (strcmp(info.what, "main") != 0) { + return 0; + } + // Mod must be listed in secure.http_mods or secure.trusted_mods lua_rawgeti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_CURRENT_MOD_NAME); if (!lua_isstring(L, -1)) { - lua_pushnil(L); - return 1; + return 0; } const char *mod_name = lua_tostring(L, -1); |