[Bug][Security] Current `package.path` feels wrong. Shouldn't load modules from CWD.
Nobody has claimed this yet.
- Dominant language
- Lua
- Stars
- 2.3k
- Forks
- 254
- PR merge metrics
- No merged PRs in 30d
Description
**Current Behavior:**
When `require`ing, Luakit loads modules from current working directory.
**Desired Behavior:**
Shouldn't do that, and should only load from a selected list. Could be in this order:
1. Local config dir (default: `$XDG_CONFIG_HOME/luakit/`)
2. Global config dir (default: `/etc/xdg/luakit/`)
3. Luakit module dir (default: `/usr/local/share/luakit/`)
4. Lua/LuaJIT lib dirs.
**How can we reproduce it (step by step):**
1. `cd /tmp`
2. `echo 'print "=====WRONG lousy.lua====="' > lousy.lua`
3. Run `luakit` and you can see that wrong `lousy.lua` is `require`d.
This feels wrong and dangerous.
**Environment:**
Linux Distribution & Version: Manjaro XFCE (X11)
Output of `luakit --version`:
```
luakit 2.3
built with webkit 2.34.6 (installed version: 2.36.3)
```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the provided /tmp steps and inspect how the luakit command configures Lua's package.path during startup. Trace the module search paths and compare them with the requested local, global, Luakit, and Lua/LuaJIT directories. Done means a lousy.lua in the current working directory is not loaded, while the selected directories remain available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100