# Differences from Standard Lua

LuaSandbox provides a sandboxed environment which differs in some ways from standard Lua 5.1.

## Features that are not available

- `dofile()`, `loadfile()`, and the `io` package, as they allow direct filesystem access. If needed, filesystem access should be done via PHP callbacks.

- The `package` package, including `require()` and `module()`, as it depends heavily on direct filesystem access. A pure-Lua rewrite such as that used in the MediaWiki Scribunto extension may be used instead.

- `load()` and `loadstring()`, to allow for static analysis of Lua code.

- `print()`, since it outputs to standard output. If needed, output should be done via PHP callbacks.

- Most of the `os` package, as it allows manipulation of the process and executing of other processes.

  - `os.clock()`, `os.date()`, `os.difftime()`, and `os.time()` remain available.

- Most of the `debug` package, as it allows manipulation of Lua state and metadata in ways that can break sandboxing.

  - `debug.traceback()` remains available.

- `string.dump()`, as it may expose internal data.

- `collectgarbage()`, `gcinfo()`, and the `coroutine` package have not been reviewed for security.

## Features that have been modified

- `pcall()` and `xpcall()` cannot catch certain errors, particularly timeout errors.

- `tostring()` does not include pointer addresses.

- `string.match()` has been patched to limit the recursion depth and to periodically check for a timeout.

- `math.random()` and `math.randomseed()` are replaced with versions that don't share state with PHP's `rand()`.

- The Lua 5.2 `__pairs` and `__ipairs` metamethods are supported by `pairs()` and `ipairs()`.