Remove debug.getupvalue from the Lua sandbox whitelist

This function could be used to steal insecure environments from trusted mods.

diff --git a/src/script/cpp_api/s_security.cpp b/src/script/cpp_api/s_security.cpp
index 36f8e9c0d9823d0cb12774e711f9628bbe09c848..730235c7bec6f3ca9b9d88b416c1b4afdddf335c 100644 (file)
--- a/src/script/cpp_api/s_security.cpp
+++ b/src/script/cpp_api/s_security.cpp
@@ -116,7 +116,6 @@ void ScriptApiSecurity::initializeSecurity()
                "upvaluejoin",
                "sethook",
                "debug",
-               "getupvalue",
                "setlocal",
        };
        static const char *package_whitelist[] = {