[英]execute lua string as lua code
I want to share lua modules with coworkers.我想与同事分享 lua 模块。 In order to get the latest version of shared modules I want to store and fetch them with a web server.
为了获得最新版本的共享模块,我想使用 web 服务器存储和获取它们。
My questions is:我的问题是:
Is it possible to load lua code directly from http request or string?是否可以直接从 http 请求或字符串加载 lua 代码?
I want to achieve something like that:我想实现这样的目标:
module = [[
local sharedModule = {}
function sharedModule.greet(name) print("hello " .. name) end
return sharedModule
]]
greeter = require (module)
greeter.greet("john")
Maybe this is not the right thing to do.也许这不是正确的做法。 Is there a better approach than this one?
有比这个更好的方法吗?
There's a whole section in Programming in Lua devoted to that. 在Lua的Programming中有一整节致力于此。 Your needs will be directly fulfilled with
loadstring
. 您的需求将通过
loadstring
直接实现。
I would carefully verify the code you're actually executing, though. 不过,我会仔细验证你实际执行的代码。 At the very least, version it (running a wrong version would most probably end up in all sorts of problems, if the code being run depends on the environment being in a certain state).
至少,版本它(运行错误的版本很可能最终会遇到各种各样的问题,如果运行的代码取决于环境处于某种状态)。 Optimally checksum and sign the code, and verify the signature before doing anything.
最佳校验和签名代码,并在执行任何操作之前验证签名。 If your environment isn't protected, this is essentially a huge backdoor opening.
如果您的环境不受保护,这实际上是一个巨大的后门开放。
You could also use rings
library to isolate the code you're running within the Lua environment itself. 你也可以使用
rings
库来隔离你Lua环境本身运行的代码。 It might not be airtight security-wise, but should at least prevent the received code from crashing your application if/when it goes awry. 它可能不是密不透风的安全方面,但至少应该防止收到的代码在应用程序出错时崩溃。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.