Add Copilot image scraping, update and fix telegram async, improve shared API

ModWinDog/Scripting/Scripting.py

@@ -3,13 +3,22 @@
 # Licensed under AGPLv3 by OctoSpacc #
 # ================================== #
 
-luaCycleLimit = 10000
-luaMemoryLimit = (512 * 1024) # 512 KB
-luaCrashMessage = f"Script has been forcefully terminated due to having exceeded the max cycle count limit ({luaCycleLimit})."
+""" # windog config start # """
 
-# Use specific Lua version; always using the latest is risky due to possible new APIs and using JIT is vulnerable
+LuaCycleLimit = 10000
+LuaMemoryLimit = (512 * 1024) # 512 KB
+LuaCrashMessage = f"Script has been forcefully terminated due to having exceeded the max cycle count limit ({LuaCycleLimit})."
+
+# see <http://lua-users.org/wiki/SandBoxes> for a summary of certainly safe objects (outdated though)
+LuaGlobalsWhitelist = ["_windog", "_VERSION", "print", "error", "assert", "tonumber", "tostring", "math", "string", "table"]
+LuaTablesWhitelist = {"os": ["clock", "date", "difftime", "time"]}
+
+""" # end windog config # """
+
+# always specify a Lua version; using the default latest is risky due to possible new APIs and using JIT is vulnerable
 from lupa.lua54 import LuaRuntime as NewLuaRuntime, LuaError, LuaSyntaxError
 
+# I'm not sure this is actually needed, but better safe than sorry
 def luaAttributeFilter(obj, attr_name, is_setting):
 	raise AttributeError("Access Denied.")
 
@@ -18,15 +27,20 @@ def cLua(context, data=None) -> None:
 	scriptText = (data.Body or (data.Quoted and data.Quoted.Body))
 	if not scriptText:
 		return SendMsg(context, {"Text": "You must provide some Lua code to execute."})
-	luaRuntime = NewLuaRuntime(max_memory=luaMemoryLimit, register_eval=False, register_builtins=False, attribute_filter=luaAttributeFilter)
+	luaRuntime = NewLuaRuntime(max_memory=LuaMemoryLimit, register_eval=False, register_builtins=False, attribute_filter=luaAttributeFilter)
 	luaRuntime.eval(f"""(function()
 _windog = {{ stdout = "" }}
 function print (text, endl) _windog.stdout = _windog.stdout .. tostring(text) .. (endl ~= false and "\\n" or "") end
-function luaCrashHandler () return error("{luaCrashMessage}") end
-debug.sethook(luaCrashHandler, "", {luaCycleLimit})
+function luaCrashHandler () return error("{LuaCrashMessage}") end
+debug.sethook(luaCrashHandler, "", {LuaCycleLimit})
 end)()""")
+	# delete unsafe objects
 	for key in luaRuntime.globals():
-		if key not in ["error", "assert", "math", "string", "tostring", "print", "_windog"]:
+		if key in LuaTablesWhitelist:
+			for tabKey in luaRuntime.globals()[key]:
+				if tabKey not in LuaTablesWhitelist[key]:
+					del luaRuntime.globals()[key][tabKey]
+		elif key not in LuaGlobalsWhitelist:
 			del luaRuntime.globals()[key]
 	try:
 		textOutput = ("[ʟᴜᴀ ꜱᴛᴅᴏᴜᴛ]\n\n" + luaRuntime.eval(f"""(function()