From a4e15b1dbee157b551478f51e415ed3c48b2e885 Mon Sep 17 00:00:00 2001 From: Maurice Schmicking Date: Sat, 8 Aug 2026 00:28:48 +0200 Subject: [PATCH 1/2] docs: add LICENSE and SECURITY.md GitHub reported the licence as NOASSERTION/Other because its detector cannot parse LICENSE.md once the vendored Lua and LuaFileSystem notices are appended. Adding a plain LICENSE with only the canonical ISC text makes it detectable; LICENSE.md keeps the third-party notices and now points at it. package.json already declared ISC, so npm was never affected. SECURITY.md records what is and is not a vulnerability here, which matters more than usual for this package: embedding Lua hands scripts os.execute, io.open and LuaFileSystem, so running untrusted Lua is out of scope by construction rather than by oversight. Misuse of the low-level stack API is likewise documented rather than treated as a defect. Adds LICENSE to the files allowlist and to the release tarball guard. Verified the guard still passes: 67 files, SECURITY.md correctly not shipped. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 2 +- LICENSE | 15 ++++++++++ LICENSE.md | 4 +++ SECURITY.md | 52 +++++++++++++++++++++++++++++++++++ package.json | 1 + 5 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 LICENSE create mode 100644 SECURITY.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f0f10ff..19cad54 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -80,7 +80,7 @@ jobs: } const files = entry.files.map(f => f.path); - const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE.md']; + const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE', 'LICENSE.md']; const missing = needed.filter(n => !files.includes(n)); if (missing.length) { console.error('missing from tarball:', missing.join(', ')); diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..2d4a9f6 --- /dev/null +++ b/LICENSE @@ -0,0 +1,15 @@ +ISC License + +Copyright (c) 2017, Medaeus245, 0x7878 + +Permission to use, copy, modify, and/or distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. diff --git a/LICENSE.md b/LICENSE.md index 0571bb5..95b5495 100644 --- a/LICENSE.md +++ b/LICENSE.md @@ -1,6 +1,10 @@ ## License & Copyrights +This project is ISC licensed. The canonical licence text lives in [LICENSE](LICENSE); +this file repeats it and adds the notices for the third-party sources compiled into +the addon. + #### The ISC Licence (ISC) Copyright (c) 2017, Medaeus245, 0x7878 Permission to use, copy, modify, and/or distribute this software for any diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d039665 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,52 @@ +# Security Policy + +## Supported versions + +| Version | Supported | +| ------- | --------- | +| 2.x | Yes | +| 1.x | No | + +1.x does not build on current Node.js and carries several memory-safety defects that +2.0.0 fixed, including a fixed-size buffer that arbitrary-length Lua error messages +were formatted into. Please upgrade rather than asking for a backport. + +## Reporting a vulnerability + +Please report privately through GitHub's +[security advisory form](https://github.com/mschmicking/node-lua-runner/security/advisories/new) +rather than opening a public issue. + +Include what you need to reproduce it: the Lua and JavaScript involved, your platform +and Node.js version, and what you observed. + +If that form is not available to you, open an issue asking for a private channel — +without the details — rather than posting them publicly. + +You should get an acknowledgement within a week or so. This is a spare-time project, +so please treat that as a good-faith aim and not a guarantee. + +## Scope + +This package embeds a Lua interpreter in your Node.js process, which shapes what +counts as a vulnerability here. + +**In scope** — anything in `src/` that lets *ordinary* use go wrong: memory +corruption, use-after-free, or a process crash reachable from normal API calls or +from Lua code with no unusual privileges. + +**Not in scope:** + +- **Running untrusted Lua.** This library gives Lua scripts the full standard + library, including `os.execute`, `io.open` and `require`, plus LuaFileSystem. A Lua + script can therefore run commands and read and write files with the privileges of + your Node.js process. That is what embedding Lua means; it is not a defect in this + package. Do not feed it code you would not run yourself. +- **Misusing the low-level stack API.** This is a thin wrapper over the Lua C API and + does not shield you from every misuse of it. Some operations on values of an + unexpected type raise an *unprotected* Lua error, which aborts the process rather + than throwing. `SetField` and `GetField` guard against this; other methods do not. + A crash reached that way is documented behaviour, not a vulnerability. +- **Findings in `vendor/`.** Lua 5.1.5 and LuaFileSystem are vendored verbatim and are + not patched here. Report those upstream. If something in them is genuinely + exploitable through this package's API, do report it here as well. diff --git a/package.json b/package.json index 77e0c38..8a1db72 100644 --- a/package.json +++ b/package.json @@ -24,6 +24,7 @@ "src/", "vendor/", "README.md", + "LICENSE", "LICENSE.md" ], "scripts": { From c586e05cac71b66194239559893179f00c964ec2 Mon Sep 17 00:00:00 2001 From: Maurice Schmicking Date: Sat, 8 Aug 2026 00:30:14 +0200 Subject: [PATCH 2/2] docs: credit Maurice Schmicking by name instead of the 0x7878 handle 0x7878 is the same person; using the legal name makes the copyright line meaningful to anyone reading it. Medaeus245 stays: that is a separate author whose 2017 copyright cannot be removed. Also splits the two holders onto their own lines, which is the conventional form for multiple copyright holders, and updates package.json to name Maurice as author with Medaeus245 as a contributor. Co-Authored-By: Claude Opus 5 --- LICENSE | 3 ++- LICENSE.md | 5 ++++- package.json | 5 ++++- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/LICENSE b/LICENSE index 2d4a9f6..37c5fd8 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,7 @@ ISC License -Copyright (c) 2017, Medaeus245, 0x7878 +Copyright (c) 2017, Medaeus245 +Copyright (c) 2023, Maurice Schmicking Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above diff --git a/LICENSE.md b/LICENSE.md index 95b5495..37f3ecf 100644 --- a/LICENSE.md +++ b/LICENSE.md @@ -5,7 +5,10 @@ This project is ISC licensed. The canonical licence text lives in [LICENSE](LICE this file repeats it and adds the notices for the third-party sources compiled into the addon. -#### The ISC Licence (ISC) Copyright (c) 2017, Medaeus245, 0x7878 +#### The ISC Licence (ISC) + +Copyright (c) 2017, Medaeus245 +Copyright (c) 2023, Maurice Schmicking (previously credited as 0x7878) Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above diff --git a/package.json b/package.json index 8a1db72..8dcbb07 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,10 @@ "name": "node-lua-runner", "version": "2.0.0", "description": "Embed Lua 5.1 in Node.js. Lua and LuaFileSystem are compiled into the addon, so there is nothing to install on the system.", - "author": "medaeus245, 0x7878", + "author": "Maurice Schmicking", + "contributors": [ + "Medaeus245" + ], "main": "index.js", "keywords": [ "lua",