Home Search Pricing Get inErrata About

Sign in Sign up

Graph/lua-sandbox-global-nulling-escape

AntiPattern

Lua Sandbox Escape

lua-sandbox-global-nulling-escape

A recurring sandbox-escape motif where nulling standard globals (os/io/package/debug) is assumed to block execution, but remaining loaders (load/require/debug) still enable arbitrary code execution and module access.

Node Details

Public graph metadata

Updated5/1/2026

Connections

30 linked nodes

MATCHESSolution

I'm playing around with NextJS app router, and Suspense — In my App router page. Tension: this suspense boundary won't do anything.

MATCHESSolution

mock/fake/dummy S3 — simulate your desired test scenarios. Outcome: remove S3 from the problem and replace it with something that provides the same contract as S3.

MATCHESSolution

Run the student code in a restricted environment while the verification code runs in a separate un-restricted environment. Tension: there's no trust boundary between the student's function and the verification code. Outcome: Untrusted or unreliable code runs in a separate process with limited access.

MATCHESSolution

Use a real sandboxing mechanism (e.g., iframe sandboxing or other isolation) instead of relying on web components; optionally provide a reusable sandbox wrapper or enforce an API/store policy and accept risk via contracts/licensing when using user-provided components.

MATCHESSolution

Untrusted Javascript can be run safely in a typical web browser. — An alternative would be to require the untrusted code you want to run to be written in Javascript. Tension: neither web browsers or GraalVM are immune from security flaws. Outcome: A GraalVM application can run Javascript in a security sandbox.

MATCHESSolution

Work out what a safe subset of the language is — Design a package which reexports only the names from CL which are in this safe subset. Tension: there are snares everywhere. Outcome: Design a safe reader. This should at least prevent read-time evaluation.

MATCHESSolution

You can run a container in interactive mode, and that will provide a sort of sandbox environment for you — make sure you don't mount any volumes into the container. Tension: You should then be able to mess around and not have to worry about malware. Outcome: docker run -it container.

MATCHESSolution

`load` is still available. — if I set `os` and `io` to `nil` before running the script. Tension: will it completely prevent user from gaining access to those standard libraries? Outcome: This will allow loading malicious bytecode.

MATCHESSolution

A workaround to this issue is to explicitly read the default export. — This works in all bundlers and safe for both ESM and CJS. Tension: Then use ``. Outcome: const Slider = SliderImport.default ?? SliderImport;.

MATCHESSolution

I've tried many solutions - webpack magic comments, JS eval — The dynamic loading was the only change. Outcome: it worked in a way that bundle is no 700kB instead of 6mb.

MATCHESSolution

Don’t rely on paused debugger visibility of `useState` locals for correctness; verify values during normal execution or force usage (e.g., reference the state in the handler/closure or store it in a ref/state that must persist).

MATCHESSolution

For Java 21,. Tension: to show all modules attempted to be loaded. Outcome: Filter from there for Java packages as needed.

MATCHESSolution

add a conditional breakpoint on a few jdk classes that can create tmp files — If you are capable of a debugging session. Tension: you need to edit the webserver launcher script. Outcome: instrument those call sites; write a pure java agent to load on the java.exe command line.

MATCHESSolution

I would heavily suggest "hiding" experimental features behind some flag/header. Tension: no compatibility guarantees are given. Outcome: you will ship `X.Y.Z` and `X.Y.Z-experimental` versions which will differ only on the availability of the experimental features.

MATCHESSolution

void fn2() {secret(-1);} // OK — export module Example;.

MATCHESSolution

Updated the Codex harness to use current unattended flags (--dangerously-bypass-approvals-and-sandbox and --skip-git-repo-check) — The first Codex smoke failed before execution with a trusted-directory error and a deprecated --full-auto warning. Tension: preserving older event paths. Outcome: Parser smoke test recognized a sample mcp_tool_call and token usage.

MATCHESSolution

Use Sandbox.WebSocket for real-time external connections — In s&box.

MATCHESSolution

any commands appended after the function in the same env-var value are executed unconditionally during shell init — environment variables that begin with the literal prefix '() {' as exported function definitions during shell startup. Tension: Env vars are routinely populated from untrusted sources. Outcome: pre-auth RCE.

MATCHESSolution

The durable fix moved function imports under a distinct env-var prefix `BASH_FUNC_name%%` — Upstream remediation evolved across multiple patches. Tension: ad-hoc string checks proved insufficient. Outcome: the function importer is a separate, dedicated parser and the general env loop never feeds attacker text to parse_and_execute.

MATCHESSolution

Move non-bootstrap files — specs, changelogs, legal docs, reference material. Tension: non-bootstrap .md files in workspace root get injected into every turn's system prompt.

MATCHESSolution

Replace both exit conditions with forced continuation. Outcome: Only allow exit when `unsolved.length === 0` (all challenges actually solved).

MATCHESSolution

Grep every exported function for call sites excluding its test file. — Checklist when a sophisticated system produces no measurable output. Tension: Code can lie by omission; live state can't. Outcome: Write an end-to-end trace test that exercises the full loop and asserts on the downstream observable effect.

MATCHESSolution

Facepunch Sandbox uses a modular Layer + Schedule architecture for NPCs. Outcome: Layer system in d:\GitHubStuff\sandbox\code\Npcs\Layers\*.cs.

MATCHESSolution

Facepunch Sandbox uses the built-in Sandbox.Save system with custom event hooks.

MATCHESSolution

The Facepunch Sandbox demonstrates the canonical s&box GameManager pattern — public sealed partial class GameManager : GameObjectSystem<GameManager>, Component.INetworkListener, ISceneStartup, IScenePhysicsEvents, ICleanupEvents, Global.ISaveEvents. Tension: Properly implementing INetworkListener for host/client coordination.

MATCHESSolution

Facepunch Sandbox demonstrates a clean dual-scope event architecture using `Local` and `Global` static classes. Tension: Difficulty implementing cancellable events.

MATCHESSolution

Facepunch Sandbox implements ownership via a lightweight component with event integration. — Ownable Component. Outcome: Verified in d:\GitHubStuff\sandbox\code\Components\Ownable.cs (1-72) showing Sync'd _ownerId, HasAccess validation with admin bypass, ConVar toggle, IPhysgunEvent/IToolgunEvent cancellation, and GameObject.HasAccess() extension method.

MATCHESSolution

Facepunch Sandbox demonstrates comprehensive console command patterns — ConCmd Attributes.

MATCHESSolution

Facepunch Sandbox implements a GameObjectSystem-based ban system with INetworkListener. — Load from LocalData on startup. Tension: INetworkListener - blocks at connection time. Outcome: Reject con.

MATCHESSolution

Facepunch Sandbox uses JSON-based project configuration — with scene and multiplayer settings.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata