Remove setlocal and setupvalue from debug table whitelist

It's likely that these could be used trick mods into revealing the insecure environment even if they do everything right (which is already hard enough).
minetest · Dec 18, 2021 · f405459 · f405459
1 parent 8c99f22
commit f405459
Showing 1 changed file with 0 additions and 2 deletions.
diff --git a/src/script/cpp_api/s_security.cpp b/src/script/cpp_api/s_security.cpp
@@ -129,12 +129,10 @@ void ScriptApiSecurity::initializeSecurity()
 		"traceback",
 		"getinfo",
 		"getmetatable",
-		"setupvalue",
 		"setmetatable",
 		"upvalueid",
 		"sethook",
 		"debug",
-		"setlocal",
 	};
 	static const char *package_whitelist[] = {
 		"config",