Page MenuHomePhabricator

Scribunto should allow coroutines in Lua
Open, LowPublic

Description

Scribunto should allow coroutines in Lua. The only explanation I've found for excluding the coroutine package is that "No application is known for us, so it has not been reviewed for security." I would like to address lack of application:

underscore.lua provides an assortment of useful functions that mediawiki wikis can benefit from having available. It uses coroutines to implement iter and range functions.

A simple coroutine example:

function range(b,e)
  return coroutine.wrap(function()
    for i = b, e do
      coroutine.yield(i);
    end
  end);
end

for n in range(1,10) do print(n); end

Author: darklama

Event Timeline

bzimport raised the priority of this task from to Low.Nov 22 2014, 1:18 AM
bzimport set Reference to bz47799.
bzimport added a subscriber: Unknown Object (MLST).

Bump.

Coroutines, for example, are a natural way to iterate through a nested table.

The stdlib project's functional library uses coroutines as well.

For the iterator usecase, I wrote a library of base iterators : that allows to https://www.wikidata.org/wiki/Module:Iterators that can be composed to make powerful stuffs.

Used it to build a library that implements https://www.w3.org/TR/sparql11-property-paths/ (some kind of regexps on graphs) on Wikibase clients : https://www.wikidata.org/wiki/Module:PropertyPath using iterators on this allows for example to stop after listing a certain number of matches without loading all the items. (edit,
https://www.wikidata.org/w/index.php?title=Module:Iterators&diff=621399261&oldid=621365189 just did)
The library does not need coroutines and was actually a HUGE help to implement property paths. I guess I could had a function that acts as a range generator in this to fulfil the usecase in this ticket as a base iterator function.

I would definitely vote for implementing coroutines, in particular to be able to use Yonaba/Moses.

I would definitely vote for implementing coroutines, in particular to be able to use Yonaba/Moses.

I implemented something like that in https://www.wikidata.org/wiki/Module:Iterators without the coroutine module. There is also the Luafun library https://github.com/luafun/luafun that does functional stuffs, totally usable in
as a Mediawiki module : https://www.wikidata.org/wiki/Module:Luafun without the coroutine module.

My own code is not perfect, as the iterators are statefull however.

Yes, usually it is possible to hack around the problem, but I can't really see a good reason why we should do that. It is far better to use common implementations that are known to work and is well maintained.

Change 626884 had a related patch set uploaded (by Alex Mashin; owner: mashin):
[mediawiki/php/luasandbox@master] Make allowed Lua globals configurable from php.ini

https://gerrit.wikimedia.org/r/626884

Is the extension still maintained?

If the point is just to enable the coroutine module then the proposed change seems unnecessarily complex. As far as I'm concerned, coroutine can be enabled if it passes a security review. If it can't pass a security review, allowing users to enable it via php.ini seems imprudent. If it can pass a security review, then it can be enabled everywhere.

If the point is just to enable the coroutine module then the proposed change seems unnecessarily complex. As far as I'm concerned, coroutine can be enabled if it passes a security review.

And the security review isn't likely to happen any time soon?

I would accept a contributed review if it looks rigorous. I'm just looking for someone to read the source and comment on potential vulnerabilities. For example:

  • Are there any loops or recursion that would allow CPU time to be consumed without the hook function being called?
  • What is baseCcalls and is it implemented correctly?
  • Is there any leakage of state across invocation boundaries, between environments?
  • Are timeout errors always respected and delivered back to PHP? Is the stack unwound correctly in the event of a timeout error?

Change 626884 abandoned by Alex Mashin:
[mediawiki/php/luasandbox@master] Make allowed Lua globals configurable from php.ini

Reason:
Not likely to be accepted anyway.

https://gerrit.wikimedia.org/r/626884