{"action":"created","issue":{"url":"https://api.github.com/repos/minetest/minetest/issues/3785","repository_url":"https://api.github.com/repos/minetest/minetest","labels_url":"https://api.github.com/repos/minetest/minetest/issues/3785/labels{/name}","comments_url":"https://api.github.com/repos/minetest/minetest/issues/3785/comments","events_url":"https://api.github.com/repos/minetest/minetest/issues/3785/events","html_url":"https://github.com/minetest/minetest/pull/3785","id":136333586,"number":3785,"title":"Require minetest.request_http_api to be called from the mod's main scope","user":{"login":"Jeija","id":1311964,"avatar_url":"https://avatars.githubusercontent.com/u/1311964?v=3","gravatar_id":"","url":"https://api.github.com/users/Jeija","html_url":"https://github.com/Jeija","followers_url":"https://api.github.com/users/Jeija/followers","following_url":"https://api.github.com/users/Jeija/following{/other_user}","gists_url":"https://api.github.com/users/Jeija/gists{/gist_id}","starred_url":"https://api.github.com/users/Jeija/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jeija/subscriptions","organizations_url":"https://api.github.com/users/Jeija/orgs","repos_url":"https://api.github.com/users/Jeija/repos","events_url":"https://api.github.com/users/Jeija/events{/privacy}","received_events_url":"https://api.github.com/users/Jeija/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-02-25T09:43:58Z","updated_at":"2016-02-26T19:22:02Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/minetest/minetest/pulls/3785","html_url":"https://github.com/minetest/minetest/pull/3785","diff_url":"https://github.com/minetest/minetest/pull/3785.diff","patch_url":"https://github.com/minetest/minetest/pull/3785.patch"},"body":"Fixes #3764 . Basically #3738 + #3765 for the HTTP API.\r\n\r\nMy test setup for the record:\r\nOne \"good\" mod that is trusted and somehow uses the curl API:\r\n```Lua\r\nprint(\"----------------------- Loading CURL Mod --------------------------\")\r\nlocal http_api = minetest.request_http_api()\r\n...\r\n```\r\n\r\nOne \"evil\" mod that is not trusted, but gets loaded *before* the good mod. The evil mod overrides `minetest.request_http_api` to get an own copy of the HTTP API. It then returns the HTTP API to the unsuspecting trusted mod:\r\n```Lua\r\nprint(\"----------------------- Loading Evil Mod --------------------------\")\r\n\r\nlocal my_request_http_api = minetest.request_http_api\r\n\r\nminetest.request_http_api = function ()\r\n\tlocal httpenv = my_request_http_api()\r\n\tprint(\"I am so evil, I got \" .. dump(httpenv))\r\n\treturn httpenv\r\nend\r\n```\r\n\r\n**This happens without this PR:**\r\n```\r\n----------------------- Loading Evil Mod --------------------------\r\n----------------------- Loading CURL Mod --------------------------\r\nI am so evil, I got {\r\n\tfetch_async_get = <function>,\r\n\tfetch_async = <function>,\r\n\tfetch = <function>\r\n}\r\n```\r\n\r\n**This happens with this PR:**\r\n```\r\n----------------------- Loading Evil Mod --------------------------\r\n----------------------- Loading CURL Mod --------------------------\r\nI am so evil, I got nil\r\n```"},"comment":{"url":"https://api.github.com/repos/minetest/minetest/issues/comments/189440413","html_url":"https://github.com/minetest/minetest/pull/3785#issuecomment-189440413","issue_url":"https://api.github.com/repos/minetest/minetest/issues/3785","id":189440413,"user":{"login":"C1ffisme","id":9893266,"avatar_url":"https://avatars.githubusercontent.com/u/9893266?v=3","gravatar_id":"","url":"https://api.github.com/users/C1ffisme","html_url":"https://github.com/C1ffisme","followers_url":"https://api.github.com/users/C1ffisme/followers","following_url":"https://api.github.com/users/C1ffisme/following{/other_user}","gists_url":"https://api.github.com/users/C1ffisme/gists{/gist_id}","starred_url":"https://api.github.com/users/C1ffisme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/C1ffisme/subscriptions","organizations_url":"https://api.github.com/users/C1ffisme/orgs","repos_url":"https://api.github.com/users/C1ffisme/repos","events_url":"https://api.github.com/users/C1ffisme/events{/privacy}","received_events_url":"https://api.github.com/users/C1ffisme/received_events","type":"User","site_admin":false},"created_at":"2016-02-26T19:22:02Z","updated_at":"2016-02-26T19:22:02Z","body":"@est31 You do have a point. Although I can see a few reasons why you would probably need access to the system and the internet. (Downloading, skins, etc.)"}}