Loadconf loads and runs conf.lua files into a new environment, built especially for conf.lua files. it behaves like a sandbox, although it doesn't provide the same security guarantees a normal sandbox would. Like any code you run on your machine, you should trust any files before you run them.
Parts of the standard library have been whitelisted, while others should be considered invalid for a conf.lua file. As a general rule, your conf.lua should be idempotent, meaning it shouldn't change your system's state, and self-contained, meaning it shouldn't rely on your system's state to provide its configuration.
The easiest way to find the full whitelist is to just read it directly from the source code. Significant functions/tables that aren't on the whitelist, and can therefore be considered blacklisted include:
- require()
- package
- load()
- dofile()
- io
- os.execute()
Also, loadconf does not emulate love.filesystem, so it can also be considered a blacklisted module.
To check to see if you're running in a loadconf sandbox, you can check
for love.filesystem. It's guaranteed to exist in all versions of LOVE,
and it's guaranteed to be nil for all loadconf sandboxes. This is an
effective guard for more complex behavior, like in the below example:
function love.conf()
t.window.width = 800
t.window.height = 600
if love.filesystem then
local cfg = love.filesystem.load(user_config) ()
t.window.width, t.window.height = cfg.width, cfg.height
end
endA program using loadconf will read this file with the default dimensions of (800, 600), while an actual love program can take user configuration into account.