docs: add LICENSE and SECURITY.md

.github/workflows/release.yml

@@ -80,7 +80,7 @@ jobs:
             }
             const files = entry.files.map(f => f.path);
 
-            const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE.md'];
+            const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE', 'LICENSE.md'];
             const missing = needed.filter(n => !files.includes(n));
             if (missing.length) {
               console.error('missing from tarball:', missing.join(', '));

LICENSE

@@ -0,0 +1,16 @@
+ISC License
+
+Copyright (c) 2017, Medaeus245
+Copyright (c) 2023, Maurice Schmicking
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

LICENSE.md

@@ -1,7 +1,14 @@
 
 ## License & Copyrights
 
-#### The ISC Licence (ISC) Copyright (c) 2017, Medaeus245, 0x7878
+This project is ISC licensed. The canonical licence text lives in [LICENSE](LICENSE);
+this file repeats it and adds the notices for the third-party sources compiled into
+the addon.
+
+#### The ISC Licence (ISC)
+
+Copyright (c) 2017, Medaeus245
+Copyright (c) 2023, Maurice Schmicking (previously credited as 0x7878)
 
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above

SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 2.x     | Yes       |
+| 1.x     | No        |
+
+1.x does not build on current Node.js and carries several memory-safety defects that
+2.0.0 fixed, including a fixed-size buffer that arbitrary-length Lua error messages
+were formatted into. Please upgrade rather than asking for a backport.
+
+## Reporting a vulnerability
+
+Please report privately through GitHub's
+[security advisory form](https://github.com/mschmicking/node-lua-runner/security/advisories/new)
+rather than opening a public issue.
+
+Include what you need to reproduce it: the Lua and JavaScript involved, your platform
+and Node.js version, and what you observed.
+
+If that form is not available to you, open an issue asking for a private channel —
+without the details — rather than posting them publicly.
+
+You should get an acknowledgement within a week or so. This is a spare-time project,
+so please treat that as a good-faith aim and not a guarantee.
+
+## Scope
+
+This package embeds a Lua interpreter in your Node.js process, which shapes what
+counts as a vulnerability here.
+
+**In scope** — anything in `src/` that lets *ordinary* use go wrong: memory
+corruption, use-after-free, or a process crash reachable from normal API calls or
+from Lua code with no unusual privileges.
+
+**Not in scope:**
+
+- **Running untrusted Lua.** This library gives Lua scripts the full standard
+  library, including `os.execute`, `io.open` and `require`, plus LuaFileSystem. A Lua
+  script can therefore run commands and read and write files with the privileges of
+  your Node.js process. That is what embedding Lua means; it is not a defect in this
+  package. Do not feed it code you would not run yourself.
+- **Misusing the low-level stack API.** This is a thin wrapper over the Lua C API and
+  does not shield you from every misuse of it. Some operations on values of an
+  unexpected type raise an *unprotected* Lua error, which aborts the process rather
+  than throwing. `SetField` and `GetField` guard against this; other methods do not.
+  A crash reached that way is documented behaviour, not a vulnerability.
+- **Findings in `vendor/`.** Lua 5.1.5 and LuaFileSystem are vendored verbatim and are
+  not patched here. Report those upstream. If something in them is genuinely
+  exploitable through this package's API, do report it here as well.

package.json

@@ -2,7 +2,10 @@
   "name": "node-lua-runner",
   "version": "2.0.0",
   "description": "Embed Lua 5.1 in Node.js. Lua and LuaFileSystem are compiled into the addon, so there is nothing to install on the system.",
-  "author": "medaeus245, 0x7878",
+  "author": "Maurice Schmicking",
+  "contributors": [
+    "Medaeus245"
+  ],
   "main": "index.js",
   "keywords": [
     "lua",
@@ -24,6 +27,7 @@
     "src/",
     "vendor/",
     "README.md",
+    "LICENSE",
     "LICENSE.md"
   ],
   "scripts": {