no way to use Settings to open an insecure path, even if we have an insecure environment

[fluxionary]

Minetest version

5.6.1

and probably everything since https://github.com/minetest/minetest/blame/master/src/script/lua_api/l_settings.cpp#L348

Summary

a mod w/ access to the insecure environment cannot use Settings to read configuration files in insecure paths.

Steps to reproduce

minetest.conf:

secure.trusted_mods = mod

modpack/modpack.conf

name = modpack

modpack/mod2/init.lua

-- empty

mod/init.lua

local ie = minetest.request_insecure_environment()
local path = minetest.get_modpath("mod2") .. "/../modpack.conf"
ie.io.open(path) -- works
Settings(path) -- crashes w/ Mod security: Blocked attempted read
ie.Settings(path) -- crashes cuz it doesn't exist

[TurkeyMcMac]

IMO this should be done by adding core.settings_from_string and Settings:to_string (the names could be different.)

[fluxionary]

IMO this should be done by adding core.settings_from_string and Settings:to_string (the names could be different.)

i only slightly object to that proposal, in that it's non-trivial to communicate that that's the proper way to solve the problem. it'd certainly be easy to implement, and dev time is finite.

[SmallJoker]

I had a look at this issue and found that modpack entries are discarded in flattenMods() and game root paths are never added to the list. It might make sense to keep track of those paths separately (mods.cpp).

Currently accessible files: (see ScriptApiSecurity::checkPath)

• any file (including mod.conf) from loaded mod's paths (read-only)
• any file in the world path but such in worldmods/ or game/