refactor(sandbox): improve sandbox (#10900)

.luacheckrc

@@ -30,7 +30,7 @@ exclude_files = {
     "bazel-kong",
 }
 
-files["kong/tools/kong-lua-sandbox.lua"] = {
+files["kong/tools/sandbox/kong.lua"] = {
      read_globals = {
         "_ENV",
         "table.pack",

kong-3.10.0-0.rockspec

@@ -217,6 +217,17 @@ build = {
     ["kong.tools.redis.schema"] = "kong/tools/redis/schema.lua",
     ["kong.tools.aws_stream"] = "kong/tools/aws_stream.lua",
 
+    ["kong.tools.sandbox"] = "kong/tools/sandbox/init.lua",
+    ["kong.tools.sandbox.kong"] = "kong/tools/sandbox/kong.lua",
+    ["kong.tools.sandbox.environment"] = "kong/tools/sandbox/environment/init.lua",
+    ["kong.tools.sandbox.environment.handler"] = "kong/tools/sandbox/environment/handler.lua",
+    ["kong.tools.sandbox.environment.lua"] = "kong/tools/sandbox/environment/lua.lua",
+    ["kong.tools.sandbox.environment.schema"] = "kong/tools/sandbox/environment/schema.lua",
+    ["kong.tools.sandbox.require"] = "kong/tools/sandbox/require/init.lua",
+    ["kong.tools.sandbox.require.handler"] = "kong/tools/sandbox/require/handler.lua",
+    ["kong.tools.sandbox.require.lua"] = "kong/tools/sandbox/require/lua.lua",
+    ["kong.tools.sandbox.require.schema"] = "kong/tools/sandbox/require/schema.lua",
+
     ["kong.runloop.handler"] = "kong/runloop/handler.lua",
     ["kong.runloop.events"] = "kong/runloop/events.lua",
     ["kong.runloop.log_level"] = "kong/runloop/log_level.lua",

kong.conf.default

@@ -1894,9 +1894,10 @@
                                  #              them. The sandboxed function has
                                  #              restricted access to the global
                                  #              environment and only has access
-                                 #              to standard Lua functions that
-                                 #              will generally not cause harm to
-                                 #              the Kong Gateway node.
+                                 #              to Kong PDK, OpenResty, and
+                                 #              standard Lua functions that will
+                                 #              generally not cause harm to the
+                                 #              Kong Gateway node.
                                  #
                                  # * `on`: Functions have unrestricted
                                  #         access to the global environment and
@@ -1920,9 +1921,6 @@
                                  # functions are not allowed, like:
                                  # `os.execute('rm -rf /*')`.
                                  #
-                                 # For a full allowed/disallowed list, see:
-                                 # https://github.com/kikito/sandbox.lua/blob/master/sandbox.lua
-                                 #
                                  # To customize the sandbox environment, use
                                  # the `untrusted_lua_sandbox_requires` and
                                  # `untrusted_lua_sandbox_environment`

kong/db/init.lua

@@ -102,7 +102,7 @@ function DB.new(kong_config, strategy)
     strategy   = strategy,
     errors     = errors,
     infos      = connector:infos(),
-    kong_config = kong_config,
+    loaded_plugins = kong_config.loaded_plugins, -- left for MigrationsState.load
   }
 
   do
@@ -444,8 +444,7 @@ do
       return nil, prefix_err(self, err)
     end
 
-    local ok, err = self.connector:schema_bootstrap(self.kong_config,
-                                                    DEFAULT_LOCKS_TTL)
+    local ok, err = self.connector:schema_bootstrap(DEFAULT_LOCKS_TTL)
 
     self.connector:close()
 

kong/db/migrations/state.lua

@@ -184,7 +184,7 @@ function State.load(db)
 
   log.debug("loading subsystems migrations...")
 
-  local subsystems, err = load_subsystems(db, db.kong_config.loaded_plugins)
+  local subsystems, err = load_subsystems(db, db.loaded_plugins)
   if not subsystems then
     return nil, prefix_err(db, err)
   end

kong/db/strategies/postgres/connector.lua

@@ -775,7 +775,7 @@ function _mt:schema_migrations()
 end
 
 
-function _mt:schema_bootstrap(kong_config, default_locks_ttl)
+function _mt:schema_bootstrap(default_locks_ttl)
   local conn = self:get_stored_connection()
   if not conn then
     error("no connection")

kong/plugins/file-log/handler.lua

@@ -24,9 +24,6 @@ local oflags = bit.bor(O_WRONLY, O_CREAT, O_APPEND)
 local mode = ffi.new("int", bit.bor(S_IRUSR, S_IWUSR, S_IRGRP, S_IROTH))
 
 
-local sandbox_opts = { env = { kong = kong, ngx = ngx } }
-
-
 local C = ffi.C
 
 
@@ -73,7 +70,7 @@ function FileLogHandler:log(conf)
   if conf.custom_fields_by_lua then
     local set_serialize_value = kong.log.set_serialize_value
     for key, expression in pairs(conf.custom_fields_by_lua) do
-      set_serialize_value(key, sandbox(expression, sandbox_opts)())
+      set_serialize_value(key, sandbox(expression)())
     end
   end
 

kong/plugins/http-log/handler.lua

@@ -16,8 +16,6 @@ local pairs = pairs
 local max = math.max
 
 
-local sandbox_opts = { env = { kong = kong, ngx = ngx } }
-
 -- Create a function that concatenates multiple JSON objects into a JSON array.
 -- This saves us from rendering all entries into one large JSON string.
 -- Each invocation of the function returns the next bit of JSON, i.e. the opening
@@ -183,7 +181,7 @@ function HttpLogHandler:log(conf)
   if conf.custom_fields_by_lua then
     local set_serialize_value = kong.log.set_serialize_value
     for key, expression in pairs(conf.custom_fields_by_lua) do
-      set_serialize_value(key, sandbox(expression, sandbox_opts)())
+      set_serialize_value(key, sandbox(expression)())
     end
   end
 

kong/plugins/loggly/handler.lua

@@ -14,9 +14,6 @@ local concat = table.concat
 local insert = table.insert
 
 
-local sandbox_opts = { env = { kong = kong, ngx = ngx } }
-
-
 local HOSTNAME = get_host_name()
 local SENDER_NAME = "kong"
 local LOG_LEVELS = {
@@ -127,7 +124,7 @@ function LogglyLogHandler:log(conf)
   if conf.custom_fields_by_lua then
     local set_serialize_value = kong.log.set_serialize_value
     for key, expression in pairs(conf.custom_fields_by_lua) do
-      set_serialize_value(key, sandbox(expression, sandbox_opts)())
+      set_serialize_value(key, sandbox(expression)())
     end
   end
 

kong/plugins/pre-function/_handler.lua

@@ -1,24 +1,13 @@
-local resty_mlcache = require "kong.resty.mlcache"
 local sandbox = require "kong.tools.sandbox"
 local kong_meta = require "kong.meta"
 
+
 -- handler file for both the pre-function and post-function plugin
 
 
 local config_cache do
-
   local no_op = function() end
 
-  local shm_name = "kong_db_cache"
-  local cache_name = "serverless_" .. shm_name
-  local cache = resty_mlcache.new(cache_name, shm_name, { lru_size = 1e4 })
-  local sandbox_kong = setmetatable({
-    cache = cache,
-    configuration = kong.configuration.remove_sensitive()
-  }, { __index = kong })
-
-  local sandbox_opts = { env = { kong = sandbox_kong, ngx = ngx } }
-
   -- compiles the array for a phase into a single function
   local function compile_phase_array(phase_funcs)
     if not phase_funcs or #phase_funcs == 0 then
@@ -28,7 +17,7 @@ local config_cache do
       -- compile the functions we got
       local compiled = {}
       for i, func_string in ipairs(phase_funcs) do
-        local func = assert(sandbox.sandbox(func_string, sandbox_opts))
+        local func = assert(sandbox.sandbox(func_string))
 
         local first_run_complete = false
         compiled[i] = function()
@@ -73,11 +62,9 @@ local config_cache do
     end
   end
 
-
   local phases = { "certificate", "rewrite", "access",
                    "header_filter", "body_filter", "log" }
 
-
   config_cache = setmetatable({}, {
     __mode = "k",
     __index = function(self, config)
@@ -96,9 +83,7 @@ local config_cache do
 end
 
 
-
 return function(priority)
-
   local ServerlessFunction = {
     PRIORITY = priority,
     VERSION = kong_meta.version,

kong/plugins/syslog/handler.lua

@@ -56,9 +56,6 @@ local FACILITIES = {
   local7 = lsyslog.FACILITY_LOCAL7
 }
 
-local sandbox_opts = { env = { kong = kong, ngx = ngx } }
-
-
 local function send_to_syslog(log_level, severity, message, facility)
   if LOG_PRIORITIES[severity] <= LOG_PRIORITIES[log_level] then
     lsyslog.open(SENDER_NAME, FACILITIES[facility])
@@ -94,7 +91,7 @@ function SysLogHandler:log(conf)
   if conf.custom_fields_by_lua then
     local set_serialize_value = kong.log.set_serialize_value
     for key, expression in pairs(conf.custom_fields_by_lua) do
-      set_serialize_value(key, sandbox(expression, sandbox_opts)())
+      set_serialize_value(key, sandbox(expression)())
     end
   end
 

kong/plugins/tcp-log/handler.lua

@@ -8,9 +8,6 @@ local ngx = ngx
 local timer_at = ngx.timer.at
 
 
-local sandbox_opts = { env = { kong = kong, ngx = ngx } }
-
-
 local function log(premature, conf, message)
   if premature then
     return
@@ -71,7 +68,7 @@ function TcpLogHandler:log(conf)
   if conf.custom_fields_by_lua then
     local set_serialize_value = kong.log.set_serialize_value
     for key, expression in pairs(conf.custom_fields_by_lua) do
-      set_serialize_value(key, sandbox(expression, sandbox_opts)())
+      set_serialize_value(key, sandbox(expression)())
     end
   end
 

kong/plugins/udp-log/handler.lua

@@ -9,9 +9,6 @@ local timer_at = ngx.timer.at
 local udp = ngx.socket.udp
 
 
-local sandbox_opts = { env = { kong = kong, ngx = ngx } }
-
-
 local function log(premature, conf, str)
   if premature then
     return
@@ -52,7 +49,7 @@ function UdpLogHandler:log(conf)
   if conf.custom_fields_by_lua then
     local set_serialize_value = kong.log.set_serialize_value
     for key, expression in pairs(conf.custom_fields_by_lua) do
-      set_serialize_value(key, sandbox(expression, sandbox_opts)())
+      set_serialize_value(key, sandbox(expression)())
     end
   end