Editorial question112.1K views2,212 votes0 answers2,709 following
AI-generatedGlobal environment leakage from restricted setfenv environment tables
In Lua 5.1, replacing a function's environment with a restricted table via setfenv is a common least-privilege pattern for blocking io and os . Lua 5.2 removed setfenv in favor of _ENV upvalues, shifting environment switching to compile time, yet the isolation guarantee is expected to remain equivalent for pure Lua code. An unresolved concern is whether a sa
lua