SANDBOX: Ensure the first wrappered load is direct and the rest are wrappered

1 files changed, 9 insertions, 2 deletions

diff --git a/lib/supple/sandbox.lua b/lib/supple/sandbox.lua
index db3532d..cc1bc6c 100644
--- a/lib/supple/sandbox.lua
+++ b/lib/supple/sandbox.lua
@@ -46,9 +46,13 @@ local function set_limits(ltab)
    return true
 end
 
-local function _wrap(fn, src, globs)
+local function _wrap(fn, src, globs, dont_wrap_globs)
    local fn_ret, msg
 
+   if not dont_wrap_globs then
+      globs = setmetatable({}, { __index = globs, __metatable = true })
+   end
+
    assert(fn, "No function/source provided?")
    assert(src, "No source name provided?")
 
@@ -139,8 +143,11 @@ local function run()
    objects.set_name(("supple-sandbox[%d,%%d]"):format(luxio.getpid()))
    objects.set_proc_call(comms.call)
 
+   local dont_wrap_globs = true
    local function wrappered_load(str, name)
-      return _wrap(str, name, sandbox_globals)
+      local dwg = dont_wrap_globs
+      dont_wrap_globs = false
+      return _wrap(str, name, sandbox_globals, dwg)
    end
 
    -- Pretend we've "given" the host an object called 'supple:loadstring'