Our great sponsors
-
-
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
I am using https://luajit.org/ in my GCC C++ project.
Can I use this faster Lua JIT in my project as a replacement? And if so, how so?
The existing luajit doesn't do v5.1, so it would be nice to use this newer engine at the newer baseline lua version level.
As far as I can tell, they aren't.
http://lua-users.org/wiki/SandBoxes
There is a lot of information there, but it doesn't handle resource exhaustion, execution time limits or give any guarantees. It does indicate that it's possible, and has a decent example of the most restrictive setup, which is a good start. But I would for example compare it with Luau's SECURITY.md.
From https://github.com/luau-lang/luau/blob/master/SECURITY.md:
> Luau provides a safe sandbox that scripts can not escape from, short of vulnerabilities in custom C functions exposed by the host. This includes the virtual machine and builtin libraries. Notably this currently does not include the work-in-progress native code generation facilities.
> Any source code can not result in memory safety errors or crashes during its compilation or execution. Violations of memory safety are considered vulnerabilities.
> Note that Luau does not provide termination guarantees - some code may exhaust CPU or RAM resources on the system during compilation or execution.
So, even luau will have trouble with untrusted code, but it specifies exactly what happens and so on. I think that's fair enough.