On Tue, Sep 1, 2015 at 2:10 PM, Lance Thornblad
<lance.thornblad@xxxxxxxxx> wrote:
On Tue, Sep 1, 2015 at 3:05 PM, Coda Highland <chighland@xxxxxxxxx> wrote:
On Tue, Sep 1, 2015 at 1:59 PM, Lance Thornblad
<lance.thornblad@xxxxxxxxx> wrote:
In my opinion, you should go ahead and write that logic in Lua, inject
the Lua code into the environment from the host environment (so you
can treat it as part of the binding API and not part of the script)
and then lock down the metatable so that user code can't mess with it.
Likewise, you can wrap FFI calls in Lua functions, keeping the FFI
namespace as an upvalue and removing the ffi object from the global
environment so that user code can't use that, either.
There are, of course, limits to sandboxing, but it's not generally
very hard to block the obvious routes.
/s/ Adam
Hmm, there is likely some merit to that approach. I'll have to consider
that against my project's other goals. One advantage that I have
currently
is that the code needed to interface my objects to some other language
is
pretty small. The more I tie in directly to Lua, the harder that
becomes,
but perhaps I just have to accept that things will not be optimized if I
don't...
As Alex suggested, can you implement the lookup as a C function
instead of a Lua C API function? Or perhaps as a set of them, if they
need to be able to return different types of values, with another
function to determine which lookup function you'll need?
/s/ Adam
What's the difference, when you say C function vs. Lua C API function?
