fixing missing pack/unpack closes #1

passed_env[k] = false would set BASE_ENV[k]

CHANGELOG.md

@@ -1,4 +1,8 @@
-v1.0.0 (2021-01)
+# v1.0.1 (2021-01)
+
+- Fix a bug in which the base environment wasn't overrideable with `false`
+
+# v1.0.0 (2021-01)
 
 - Added support for all major versions of PUC Rio Lua and LuaJIT
 - Only Lua strings are admitted now, "naked Lua" functions are not permitted any more
@@ -8,6 +12,6 @@ v1.0.0 (2021-01)
 - Environments can have metatables with indexes, and they are respected
 - Environments can override the base environment
 
-v0.5.0 (2013)
+# v0.5.0 (2013)
 
 Initial version

README.md

@@ -164,6 +164,10 @@ Installation
 
 Just copy sandbox.lua wherever you need it.
 
+Alternatively, you can use luarocks:
+
+    luarocks install kikito/sandbox
+
 License
 =======
 

sandbox-1.0.1-4.rockspec

@@ -1,15 +1,15 @@
-package = "sandbox.lua"
+package = "sandbox"
 
-version = "0.0.1-0"
+version = "1.0.1-4"
 
 source = {
-   url = "git://github.com/kikito/sandbox.lua.git",
+   url = "git+https://github.com/kikito/lua-sandbox",
-   tag = "0.0.1"
+   tag = "v1.0.1"
 }
 
 description = {
    summary = "A pure-lua solution for running untrusted Lua code.",
-   homepage = "https://github.com/kikito/sandbox.lua",
+   homepage = "https://github.com/kikito/lua-sandbox",
 }
 
 dependencies = {

sandbox.lua

@@ -1,5 +1,5 @@
 local sandbox = {
-  _VERSION      = "sandbox 0.5",
+  _VERSION      = "sandbox 0.5.1",
   _DESCRIPTION  = "A pure-lua solution for running untrusted Lua code.",
   _URL          = "https://github.com/kikito/sandbox.lua",
   _LICENSE      = [[
@@ -29,6 +29,24 @@ local sandbox = {
 
 }
 
+-- 0.5.1 fixing missing pack and unpack functions for some Lua versions
+if not table.pack then
+  table.pack = function(...)
+    local t = {...}
+    t.n = select("#", ...)
+    return t
+  end
+end
+if not table.unpack then
+  table.unpack = function(tab, start, finish)
+    local result = {}
+    for i = start or 1, finish or #tab do
+      result[#result + 1] = tab[i]
+    end
+    return result
+  end
+end
+
 -- quotas don't work in LuaJIT since debug.sethook works differently there
 local quota_supported = type(_G.jit) == "nil"
 sandbox.quota_supported = quota_supported
@@ -134,7 +152,11 @@ function sandbox.protect(code, options)
   local env = {}
   for k, v in pairs(BASE_ENV) do
     local pv = passed_env[k]
-    env[k] = pv ~= nil and pv or v
+    if pv ~= nil then
+      env[k] = pv
+    else
+      env[k] = v
+    end
   end
   setmetatable(env, { __index = options.env })
   env._G = env

spec/sandbox_spec.lua

@@ -135,6 +135,11 @@ describe('sandbox.run', function()
       local env = { tostring = function(x) return "hello " .. x end }
       assert.equal("hello peter", sandbox.run("return tostring('peter')", { env = env }))
     end)
+
+    it('can override the base env with false', function()
+      local env = { tostring = false }
+      assert.equal(false, sandbox.run("return tostring", { env = env }))
+    end)
   end)
 
 end)