Remove loadfile() access from the scripting engine.

diff --git a/src/scripting.c b/src/scripting.c
index 4c7de33bf1d67c3b2038942fb467f9bb66b0ae77..a5f5683e15db14bbd818fcf87561dda4f7c75c60 100644 (file)
--- a/src/scripting.c
+++ b/src/scripting.c
@@ -412,6 +412,13 @@ void luaLoadLibraries(lua_State *lua) {
 #endif
 }
 
 #endif
 }
 

+/* Remove a functions that we don't want to expose to the Redis scripting
+ * environment. */
+void luaRemoveUnsupportedFunctions(lua_State *lua) {
+    lua_pushnil(lua);
+    lua_setglobal(lua,"loadfile");
+}
+

 /* This function installs metamethods in the global table _G that prevent
  * the creation of globals accidentally.
  *
 /* This function installs metamethods in the global table _G that prevent
  * the creation of globals accidentally.
  *


@@ -455,7 +462,9 @@ void scriptingEnableGlobalsProtection(lua_State *lua) {
  * See scriptingReset() for more information. */
 void scriptingInit(void) {
     lua_State *lua = lua_open();
  * See scriptingReset() for more information. */
 void scriptingInit(void) {
     lua_State *lua = lua_open();

+

     luaLoadLibraries(lua);
     luaLoadLibraries(lua);

+    luaRemoveUnsupportedFunctions(lua);

 
     /* Initialize a dictionary we use to map SHAs to scripts.
      * This is useful for replication, as we need to replicate EVALSHA
 
     /* Initialize a dictionary we use to map SHAs to scripts.
      * This is useful for replication, as we need to replicate EVALSHA