Merge branch 'main' of https://github.com/ThingsPanel/thingspanel-backend-community

Author: jie

internal/processor/executor.go

@@ -186,8 +186,15 @@ func (e *LuaExecutor) setupSandbox(L *lua.LState) {
 	// PreloadModule 需要访问 package.preload 表
 	L.PreloadModule("json", luajson.Loader)
 
+	// 兼容旧脚本中的 os.time()，但不开放 os.execute、os.remove 等危险能力。
+	originalOS := L.GetGlobal("os")
+	safeOS := L.NewTable()
+	if osTable, ok := originalOS.(*lua.LTable); ok {
+		safeOS.RawSetString("time", osTable.RawGetString("time"))
+	}
+
 	// 禁用危险的标准库
-	L.SetGlobal("os", lua.LNil)           // 禁用 os 库（操作系统操作）
+	L.SetGlobal("os", safeOS)             // 仅保留安全且向后兼容的 os.time
 	L.SetGlobal("io", lua.LNil)           // 禁用 io 库（文件 IO）
 	L.SetGlobal("dofile", lua.LNil)       // 禁用 dofile
 	L.SetGlobal("loadfile", lua.LNil)     // 禁用 loadfile

internal/processor/executor_test.go

@@ -0,0 +1,64 @@
+package processor
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+)
+
+func TestExecuteEncodeAllowsLegacyOSTime(t *testing.T) {
+	const script = `
+function encodeInp(msg,topic)
+    local json = require("json")
+    local originCmd = json.decode(msg)
+
+    local output = string.format(
+        '{"method":"%s","params":{"params":%s,"id":"%s","version":"1.0","method":"thing.service.property.set"}}',
+        originCmd.method,
+        json.encode(originCmd.params),
+        tostring(os.time())
+    )
+
+    return output
+end`
+
+	result, err := NewLuaExecutor().ExecuteEncode(
+		context.Background(),
+		script,
+		[]byte(`{"method":"CO2","params":{"CO2":2223}}`),
+	)
+	if err != nil {
+		t.Fatalf("legacy script execution failed: %v", err)
+	}
+
+	var output struct {
+		Method string `json:"method"`
+		Params struct {
+			ID string `json:"id"`
+		} `json:"params"`
+	}
+	if err := json.Unmarshal([]byte(result), &output); err != nil {
+		t.Fatalf("result is not valid JSON: %v", err)
+	}
+	if output.Method != "CO2" {
+		t.Fatalf("unexpected method: %q", output.Method)
+	}
+	if output.Params.ID == "" {
+		t.Fatal("os.time() returned an empty id")
+	}
+}
+
+func TestSandboxDoesNotExposeDangerousOSFunctions(t *testing.T) {
+	const script = `
+function encodeInp(msg,topic)
+    return tostring(os.execute == nil and os.remove == nil and os.getenv == nil)
+end`
+
+	result, err := NewLuaExecutor().ExecuteEncode(context.Background(), script, []byte(`{}`))
+	if err != nil {
+		t.Fatalf("sandbox check failed: %v", err)
+	}
+	if result != "true" {
+		t.Fatalf("dangerous os functions are exposed: %q", result)
+	}
+}