From b487783c239d75338254ae8bc7250ba6141d67a6 Mon Sep 17 00:00:00 2001
From: Pedro Gimeno <pgimeno@email.fake>
Date: Mon, 14 Mar 2016 14:29:34 +0100
Subject: [PATCH] Disable JIT optimization for user code and allow string.find
 in plain mode

Disabling LuaJIT for user code enables normal working of debug.sethook() even for loops. The drawback is that that code will run more slowly.

The fourth parameter of string.find indicates whether the second parameter should be interpreted literally (true) or as a pattern (false). Allowing patterns enables DoS attacks, but it's possible to
allow literal matching with little effort, by disallowing the function only if the fourth parameter (plain mode) is not `true`.
---
 mesecons_luacontroller/init.lua | 56 +++++++++++++--------------------
 1 file changed, 21 insertions(+), 35 deletions(-)

diff --git a/mesecons_luacontroller/init.lua b/mesecons_luacontroller/init.lua
index 7df2bdc..e669f93 100644
--- a/mesecons_luacontroller/init.lua
+++ b/mesecons_luacontroller/init.lua
@@ -216,6 +216,17 @@ local function safe_string_rep(str, n)
 	return string.rep(str, n)
 end
 
+-- string.find with a pattern can be used to DoS the server.
+-- Therefore, limit string.find to patternless matching.
+local function safe_string_find(...)
+	if (select(4, ...)) ~= true then
+		debug.sethook() -- Clear hook
+		error("string.find: 'plain' (fourth parameter) must always be true in a LuaController")
+	end
+
+	return string.find(...)
+end
+
 local function remove_functions(x)
 	local tp = type(x)
 	if tp == "table" then
@@ -292,6 +303,7 @@ local function create_environment(pos, mem, event)
 			rep = safe_string_rep,
 			reverse = string.reverse,
 			sub = string.sub,
+			find = safe_string_find,
 		},
 		math = {
 			abs = math.abs,
@@ -354,22 +366,6 @@ local function timeout()
 end
 
 
-local function code_prohibited(code)
-	-- LuaJIT doesn't increment the instruction counter when running
-	-- loops, so we have to sanitize inputs if we're using LuaJIT.
-	if not rawget(_G, "jit") then
-		return false
-	end
-	local prohibited = {"while", "for", "repeat", "until", "goto"}
-	code = " "..code.." "
-	for _, p in ipairs(prohibited) do
-		if string.find(code, "[^%w_]"..p.."[^%w_]") then
-			return "Prohibited command: "..p
-		end
-	end
-end
-
-
 local function create_sandbox(code, env)
 	if code:byte(1) == 27 then
 		return nil, "Binary code prohibited."
@@ -378,24 +374,17 @@ local function create_sandbox(code, env)
 	if not f then return nil, msg end
 	setfenv(f, env)
 
+	-- Turn off JIT optimization for user code so that count
+	-- events are generated when adding debug hooks
+	if rawget(_G, "jit") then
+		jit.off(f, true)
+	end
+
 	return function(...)
-		-- Normal Lua: Use instruction counter to stop execution
-		-- after luacontroller_maxevents.
-		-- LuaJIT: Count function calls instead of instructions, allows usage
-		-- of function keyword. However, LuaJIT still doesn't trigger
-		-- lines events when using infinite loops.
+		-- Use instruction counter to stop execution
+		-- after luacontroller_maxevents
 		local maxevents = mesecon.setting("luacontroller_maxevents", 10000)
-		if not rawget(_G, "jit") then
-			debug.sethook(timeout, "", maxevents)
-		else
-			local events = 0
-			debug.sethook(function ()
-				events = events + 1
-				if events > maxevents then
-					timeout()
-				end
-			end, "c")
-		end
+		debug.sethook(timeout, "", maxevents)
 		local ok, ret = pcall(f, ...)
 		debug.sethook()  -- Clear hook
 		if not ok then error(ret, 0) end
@@ -432,9 +421,6 @@ local function run(pos, event)
 	local mem  = load_memory(meta)
 	local code = meta:get_string("code")
 
-	local err = code_prohibited(code)
-	if err then return err end
-
 	-- Create environment
 	local env = create_environment(pos, mem, event)