Lua code is expected to be sandboxed so that one #invoke session can never impact another invoke session, and so that certain sensitive functions cannot be run from Mediawiki Modules.
I've discovered a set of behaviors that allows one to violate the sandbox.
A working (though weak) version of this exploit can be seen using:
http://test2.wikipedia.org/wiki/Module:MessageTest1
http://test2.wikipedia.org/wiki/Module:MessageTest2
Executed at:
http://test2.wikipedia.org/wiki/Module_talk:MessageTest2
This example shows how the user can pass messages from one invoke session to another.
When MessageTest1 is loaded via require (or mw.loadData), for some reason its table ("message") appears to be stored in the global environment. Subsequently, one can use an indirect call _G.message to access functions loaded from MessageTest1. Those functions then appear to run in the global space and be able to violate the sandboxing rules. In this example by storing a variable in the global space to be retrieved later. However, I don't think there are any limits to what those functions are allowed to do.
A related problem is that data loaded via require can also overload functions and values in the global space even without using the _G. construction. For example, is a required Module contains the code "mw.clone = {};" then once required the global function mw.clone will be overwritten. This causes all future invoke calls to fail since mw.clone is required to run at the start of each Lua session.
Require calls shouldn't be overwriting functions in the global space, and the sandboxing needs to be fixed so that code loaded via require can't later be used to access the global space.
Version: unspecified
Severity: normal