Loadstring() for one specific restricted use - any security risks?

Help and Feedback Scripting Support
, , , ,
23

Oh yeah I forgot about tables, since math library in this case never needs tables you can add a literal check to the function:

local CharacterLimit = 50

local function IsSafe(String)
    String = string.gsub(string.lower(String), "x", "")
    if #String > CharacterLimit then return false end

    local Safe = true

    for Match in string.gmatch(String, "math%.(%w+)") do
        if not math[Match] then
            Safe = false
        end

        String = string.gsub(String, "math%." .. Match, "")
    end

    return Safe and string.find(String, "[%a{}]") == nil
end

print(IsSafe("math.sqrt(1 + 2) x 5"))
print(IsSafe("{{{{}}}}}"))