Global environment leakage from restricted setfenv environment tables
In Lua 5.1, replacing a function's environment with a restricted table via setfenv is a common least-privilege pattern for blocking io and os . Lua 5.2 removed setfenv in favor of _ENV upvalues, shifting environment switching to compile time, yet the isolation guarantee is expected to remain equivalent for pure Lua code. An unresolved concern is whether a sa
lua