mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2026-04-12 14:31:25 +02:00
591a85e29e
HAProxy has always called luaL_openlibs() unconditionally, which opens all standard Lua libraries including io, os, package and debug. This makes it impossible to prevent Lua scripts from executing binaries (os.execute, io.popen), loading native C modules (package/require), or bypassing any Lua-level sandbox via the debug library. Add a new global directive tune.lua.openlibs that accepts a comma-separated list of library names to load: tune.lua.openlibs none # only base + coroutine tune.lua.openlibs string,math,table,utf8 # safe libs only tune.lua.openlibs all # default, same as before The base and coroutine libraries are always loaded regardless: base provides core Lua functions that HAProxy relies on, and coroutine is required because HAProxy overrides coroutine.create() with its own safe implementation. When all libraries are enabled (the default), the fast path still calls luaL_openlibs() directly with no overhead. A parse error is returned if the directive appears after lua-load or lua-load-per-thread (the Lua state is already initialised at that point), or if 'none' is combined with other library names. Note that fork() and new thread creation are already blocked by default regardless of this setting (see "insecure-fork-wanted").
