Can Lupa be used to run untrusted lua code in python? -

let's create luaruntime register_eval=false , attribute_filter prevents access except few python functions. safe assume lua code won't able os.system("rm -rf *") or that?

from looking @ lupa doc:

restricting lua access python objects

lupa provides simple mechanism control access python objects. each attribute access can passed through filter function follows...

it doesn't preventing or limiting access facilities provided lua itself. if no other modifications done luaruntime environment lua script can indeed os.execute("rm -rf *").

to control kind of environment lua script works in can use setfenv , getfenv sandbox script before running it. example:

import lupa l = lupa.luaruntime() sandbox = l.eval("{}") setfenv = l.eval("setfenv")  sandbox.print   = l.globals().print sandbox.math    = l.globals().math sandbox.string  = l.globals().string sandbox.foobar  = foobar # etc...  setfenv(0, sandbox) 

now doing l.execute("os.execute('rm -rf *')") result in script error.