C++ - Lua Preventing malicious lua code

Im working on a "game" that uses lua for scripting and i plan on making it very mod-able. However, malicious code can be written without much difficulty in lua... So how can i go about stopping that? I could block certain functions, but that wouldn't be nice for the modders and those who really want to will find another way.

could block certain functions, but that wouldn't be nice for the modders

It's perfectly nice for modders and is basically what everyone does. The only ones you need to restrict are the IO functions, of course, since Lua doesn't really include anything else out of the box.

You can instead of "blocking" them replace them with your own versions that do extra checks such as ensuring that all paths are contained within your game's script data folder (be sure to protect against .. and funky versions of / vs \).

and those who really want to will find another way.

Yes. Yes they will. They'll find a way to break the sandbox, or just abuse a bug in your code; a bug that might even be exploitable with a properly crafted texture file, because software is hard.

Which is why you should never ever never never auto-download mod packs for the player. That is, don't ever have the idea that you should auto-install required mods for a server that the player doesn't have. Instead have a mod repository where users can search, rate, and comment upon mods and from which any mod found to be malicious can be removed and the author banned and reported to authorities.

Miscreants still intent on abusing your players via your game will do so in so very many more stupid ways than trying to hack your script integration, even if you do allow unsafe scripts. The most common is still just good old social engineering: convincing players to download random malware in the guise of mods ("see $character$ in teh nudez!! jus download dis exe!!!~").

• Thanks. However, even if i block all the lua io. ... functions you can find library's for IO. So, should i block require() too? – James Pae Jul 31 '16 at 10:12
• @JamesPae any Lua-only libraries included in a Lua script with I/O have to call upon Lua's I/O API, that goes for anything else that talks to the operating system, it all goes through the Lua standard libraries (or functions your game exposes). – user5665 Jul 31 '16 at 19:47
• To clarify: yes, a user could install extra C code to bypass your checks. See for instance the SKSE/NVSE "script extenders" for Bethesda's engines. Once your game is on the user's computer, there's nothing you can reasonably do to stop them from modifying the crap out of it. – Sean Middleditch Aug 1 '16 at 18:24