I program in Lua and I need some help:

I have file1.lua and file2.lua

In file1.lua:

loadstring('print("Hello World!")')

in file2.lua:

_loadstring = loadstring

function loadstring(code)
    iprint("The code is:", code)
    return _loadstring(code)()
end

Basically, file2.lua allows me to see the code that is being passed inside the loadstring. Would it be possible for me to COMPLETELY BLOCK modification of the loadstring function? So that it cannot be accessed/intercepted in other places?

I want to ensure security when executing client-side code, but if I cannot block this interception it will be difficult because I intend to encrypt the code, decrypt it and put a loadstring for it to work.

EDIT:

I'm still looking for alternatives and I thought of something:

It's like my code starts like this:

_loadstring = loadstring

function loadstring(code)
iprint("The code is:", code)
return _loadstring(code)()
end

loadstring('print("Hello World!")')

Can't I guarantee that the second loadstring called is the Lua loadstring? Force it to use the exact Lua loadstring instead of any other?

I program in Lua and I need some help:

I have file1.lua and file2.lua

In file1.lua:

loadstring('print("Hello World!")')

in file2.lua:

_loadstring = loadstring

function loadstring(code)
    iprint("The code is:", code)
    return _loadstring(code)()
end

Basically, file2.lua allows me to see the code that is being passed inside the loadstring. Would it be possible for me to COMPLETELY BLOCK modification of the loadstring function? So that it cannot be accessed/intercepted in other places?

I want to ensure security when executing client-side code, but if I cannot block this interception it will be difficult because I intend to encrypt the code, decrypt it and put a loadstring for it to work.

EDIT:

I'm still looking for alternatives and I thought of something:

It's like my code starts like this:

_loadstring = loadstring

function loadstring(code)
iprint("The code is:", code)
return _loadstring(code)()
end

loadstring('print("Hello World!")')

Can't I guarantee that the second loadstring called is the Lua loadstring? Force it to use the exact Lua loadstring instead of any other?

• lua
• lua-table

• Overwritten? Do you mean overridden? – user207421 Commented Mar 30 at 3:39
• I need to block the function from being changed, or if it doesn't search for the original function without any modification – kaleb sociais Commented Mar 30 at 14:08
• Does your code relies on loadstring() to execute user's code, and does that user require() your code, so that you are afraid that, before require() the user will redefine loadstring()? – Alexander Mashin Commented Mar 31 at 17:41

1 Answer 1

It sounds like you may not need to as long as you're executing loadstring server-side (if someone is overriding your loadstring at that point they already have the keys to the kingdom)

Nearest thing you can get is namespacing your function to a table and overriding __newindex

local l = {}

local set = false
l = setmetatable(l, {
    __newindex = function(t, key, value)
        if key == 'oadstring' then
            if set == false then
                set = true
                t[k] = value
            else
                print('stop!')
            end
        end
    end
})

function l.oadstring() end # Set once

function l.oadstring() print('overridden') end
# stop!
l.oadstring = function() print('overridden') end
# stop!

At which point someone would have to replace the l table to redefine the function and inject their version in every file that relies on it without breaking anything (but, again, I don't think you need to do this).