[Linuxdcpp-team] [Bug 2047732] Re: [PoC] RCE in ScriptPlugin 1.0

2024-01-01 Thread cologic
Per https://www.lua.org/manual/5.2/manual.html#6.7 Lua 5.2 defines the bit operators as bit32.arshift(), bit32.band(), bit32.bnot(), et cetera. As https://www.lua.org/manual/5.3/manual.html#3.4.2 describes, Lua 5.3 instead replaces them with operators &, |, ~ (both not and xor), >>, and << while de

[Linuxdcpp-team] [Bug 2047732] Re: [PoC] RCE in ScriptPlugin 1.0

2024-01-01 Thread RoLex
Lua didn't remove bitlib, it's provided via math module instead. -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/2047732 Title: [PoC] RCE in ScriptPlugin 1.0 Status in DC++: New Status in DC++ pl

[Linuxdcpp-team] [Bug 2047732] Re: [PoC] RCE in ScriptPlugin 1.0

2024-01-01 Thread cologic
Regarding a release, because the main pending things were this and a Lua 5.4 update, and it seemed worth separating testing timelines on each so that the Lua 5.4 update could be kept testing for longer to pick up potential issus (e.g., people depending on the bit32 library Lua 5.4 removes), the Scr

[Linuxdcpp-team] [Bug 2047732] Re: [PoC] RCE in ScriptPlugin 1.0

2024-01-01 Thread cologic
LuaExec has been removed from ScriptPlugin: https://sourceforge.net/p/dcnetwork/code/ci/c3c681a07798fb7c5da2c0aae8995690284735d2/ -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/2047732 Title: [PoC]