Lua: Sandbox by default (whitelisted functions); Disable inline scripts for now; Add more checks for security reasons (#7136)

https://github.com/XTLS/Xray-core/pull/7136#issuecomment-6158632073 https://github.com/XTLS/Xray-core/pull/7136#issuecomment-6170831601 https://github.com/XTLS/Xray-core/pull/7136#issuecomment-6184362904
2026-10-16 20:44:03 +00:00 · 2026-10-16 01:55:35 +00:00
parent 8703fdb101
commit ac5d8a83ba
30 changed files with 2209 additions and 56 deletions
@@ -30,6 +30,7 @@ func newScriptEngine(script string) (*scriptEngine, error) {
 func (e *scriptEngine) start(server *DNS) error {
 	pool, err := xlua.NewPool(server.ctx, scriptExecutionTimeout, e.program.NewStateFactory(
 		scriptExecutionTimeout*20,
+		256,
 		func(L *lua.LState) {
 			geodata.RegisterLua(L)
 			log.RegisterLua(L)