A problem with all scripting languages is to make them powerful enough to be useful, but not too powerful that they could be abused by malicious scripts.
Lua has a nice solution to this problem. You can make a Lua "sandbox" by disabling functions that you consider dangerous.
For example, if you don't want people to use the Note function you can do this:
After doing this, although the code for Note still exists (it is inside the MUSHclient executable) you have removed the link from the word "Note" to the code, thus disabling it.
You can be more sophisticated than that, for example disabling a particular word. Here is an example of doing that:
If executed, the above code will replace the Note function with one that permanently disables being able to note a string with the word "turkey" in it.
It does this by saving the original Note function into a local variable, and then replacing it with its own version that checks for the word 'turkey', raising an error if found. If not found, it calls the original saved function.
MUSHclient's preliminary code
To help block out dangerous functions, for example:
... MUSHclient has a 'preliminary script' box in its Global Preferences -> Lua section.
This has code that disables some 'dangerous' functions (like 'os') by setting them to nil.
If you are not planning to run untrusted scripts (eg. plugins) then you can edit that code and comment-out any parts you feel comfortable with having available to your scripts.
The code in this box is executed every time the Lua script engine is instantiated, in other words for every world, and every plugin.
There are suggestions in the default script for how you might modify it to block certain plugins (or worlds) but not others, from having access to dangerous commands.
Lua has a nice solution to this problem. You can make a Lua "sandbox" by disabling functions that you consider dangerous.
For example, if you don't want people to use the Note function you can do this:
world.Note = nil
After doing this, although the code for Note still exists (it is inside the MUSHclient executable) you have removed the link from the word "Note" to the code, thus disabling it.
You can be more sophisticated than that, for example disabling a particular word. Here is an example of doing that:
do
local oldnote = Note
Note = function (...)
for k, v in pairs (arg) do
if string.find (v, "turkey") then
error "Invalid note"
end -- if
end -- for
oldnote (unpack (arg))
end -- function
end -- do
If executed, the above code will replace the Note function with one that permanently disables being able to note a string with the word "turkey" in it.
It does this by saving the original Note function into a local variable, and then replacing it with its own version that checks for the word 'turkey', raising an error if found. If not found, it calls the original saved function.
MUSHclient's preliminary code
To help block out dangerous functions, for example:
os.execute "del mushclient.exe"
... MUSHclient has a 'preliminary script' box in its Global Preferences -> Lua section.
This has code that disables some 'dangerous' functions (like 'os') by setting them to nil.
If you are not planning to run untrusted scripts (eg. plugins) then you can edit that code and comment-out any parts you feel comfortable with having available to your scripts.
The code in this box is executed every time the Lua script engine is instantiated, in other words for every world, and every plugin.
There are suggestions in the default script for how you might modify it to block certain plugins (or worlds) but not others, from having access to dangerous commands.